Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-10-2024 18:19
Behavioral task
behavioral1
Sample
103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe
Resource
win10v2004-20241007-en
General
-
Target
103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe
-
Size
54KB
-
MD5
736feb30f912ec759602226c17822930
-
SHA1
67b8f6a43b0af45ed9000877de00f1750f404fdb
-
SHA256
103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcf
-
SHA512
be25a8c7668a69a51d13baa9f66263e90975e2746dffb16ca85f633c15c1a52989358243a0078a8f1a1e546b80ed6799e9b9986c7d0de632f1a1615e97e6954c
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9Yo0NO6iJfo0NO6iJ+:V7Zf/FAxTWoJJ7T+mR
Malware Config
Signatures
-
Renames multiple (3193) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2676-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000c000000012268-2.dat upx behavioral1/files/0x0002000000010541-6.dat upx behavioral1/memory/2676-72-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ho_Chi_Minh.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-modules.jar.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_ja.jar.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_ja.jar.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jre7\lib\psfontj2d.properties.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Moncton.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-charts.xml.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\VideoLAN\VLC\lua\modules\simplexml.luac.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_win7.css.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Qyzylorda.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\StopEnable.contact.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\GMT.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jre7\lib\deploy\messages.properties.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_ja.jar.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_ja.jar.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\MANIFEST.MF.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_ja_4.4.0.v20140623020002.jar.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.ja_5.5.0.165303.jar.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.configuration_5.5.0.165303.jar.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Lisbon.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\PYCC.pf.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Helsinki.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_ja.jar.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Resources.dll.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\7-Zip\Lang\tr.txt.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_ja.jar.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jre7\bin\ssvagent.exe.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Perth.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-explorer.xml.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_ja.jar.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jre7\bin\jli.dll.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.ServiceModel.Resources.dll.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_70.png.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-search.xml.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Juan.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark.css.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_SelectionSubpicture.png.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-favorites.xml.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Microsoft Office\Office14\1033\MAPISHELLR.DLL.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Engine.resources.dll.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.css.sac_1.3.1.v200903091627.jar.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Tokyo.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\ShvlRes.dll.mui.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.xml.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitevignette1047.png.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\javafx.properties.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup-impl.xml.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe File created C:\Program Files\Java\jre7\bin\servertool.exe.tmp 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe"C:\Users\Admin\AppData\Local\Temp\103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2676
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD57bec10250bdf9e29a4b56e00c490570b
SHA1a61bf2912bd993048533c63d8e1785bb7e195be0
SHA256584ca0d0a736e7341e0be210c8cff9d2a32be2b30c050e913ac759537e1b4bee
SHA512e282c3632f2e965fdf95c0f5dff07644de85187903d4fd93bf5e1e2e837f174ce28f62c9b74936ab30c6285e0425396d741f27211ac90d5d87deff1065de836d
-
Filesize
63KB
MD50a59f0bb8b1b65cc87d36b117516bf0e
SHA1efa37ff9c3238e771b141e7ddd70f306e4bc6d1d
SHA2562416d9e3de387b74433c8a8275a431f93477b71cff29e75623b01763832abe71
SHA512c6c636e42313f59b471c00cf90da2d2a3e8f00ec35bb26e9e723e6a6268343d29d0c71f65c3d6f5ada6f5838646d61774bade13bea32485b1bbd70d2c656ab78