Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-10-2024 18:18
Static task
static1
Behavioral task
behavioral1
Sample
0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe
Resource
win10v2004-20241007-en
General
-
Target
0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe
-
Size
89KB
-
MD5
d78fc315257b9cfeadf31b327a329c80
-
SHA1
14c41b5482ec56d7a7c3be886b4723840e35e7c6
-
SHA256
0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525c
-
SHA512
f16f622b52335cb9a217d204d0b503b05d45c7537f0d27875af6033a499b539ee0202b774148e47f577275d904026f971a62692f10a6b602b68bf889999ede3d
-
SSDEEP
1536:W7ZDpApYbWjIoPyPoLzV7c6ShWfxRfxMl2:6DWpLf7fWl2
Malware Config
Signatures
-
Renames multiple (2857) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\glass.dll.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chatham.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.core_2.3.5.v201308161310.jar.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-utility-l1-1-0.dll.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Jerusalem.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref.wmv.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Java\jre7\lib\images\cursors\win32_CopyDrop32x32.gif.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Damascus.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Jayapura.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\msinfo32.exe.mui.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Costa_Rica.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.ServiceModel.Resources.dll.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.util_1.0.500.v20130404-1337.jar.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-core.xml.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\Marengo.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Minsk.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Mozilla Firefox\firefox.exe.sig.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_cs.jar.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Microsoft Games\Chess\en-US\Chess.exe.mui.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.properties.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\topnav.gif.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Mozilla Firefox\xul.dll.sig.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\AST4.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Mozilla Firefox\AccessibleHandler.dll.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Microsoft Games\Purble Place\de-DE\PurblePlace.exe.mui.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\VideoLAN\VLC\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkObj.dll.mui.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_elf.dll.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-options.jar.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Cayenne.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_SelectionSubpicture.png.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Helsinki.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\MANIFEST.MF.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_zh_CN.jar.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpnr.dll.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Mozilla Firefox\firefox.exe.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.xml.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Java\jre7\lib\net.properties.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Currie.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-lib-uihandler.xml.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-tools.xml.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Microsoft Games\Chess\it-IT\Chess.exe.mui.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata_5.5.0.165303.jar.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Java\jre7\lib\cmm\CIEXYZ.pf.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Galapagos.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.lnk.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Cordoba.tmp 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe"C:\Users\Admin\AppData\Local\Temp\0378d26c86e285ba1ce1a161be28e5c45bfd56b8eb82d5e729ce8b1ab481525cN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2236
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD5341065cf950e7cc06a4c534a44a17eff
SHA1c6da4e358a327ac4d02a0c495f8e7708b67db1a4
SHA256ef86452d7bba22cdce3390d036fe58df7c24ed2f0b63a64789df6be81a69710b
SHA5123a10ceb624185217c0c27e3a864d5a4a7dcfc2d4bc63b918a5182e4e2a00c5dedae51ce33584e8b2e4e5a1e69387c7a8d7d6cf7bc1a89b85b934527e7f398850
-
Filesize
98KB
MD53b935423071f53a522b34be36e4dff4f
SHA1717e2947faf3c12cbb74c4a63791fa866ca35c5d
SHA256306c7da1c7949fa755b5248e57d61a4bc9833100679cf2b2d12255f7181b13df
SHA512ab86a3473ec85fd0a138c02f9ae508eafa3fe1ae64a70b07363d93a55c69499f24ec815f0d25bb317fc6d25070b4ed49b662158f384a00c8b41a930bcd5ea8fc