Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
18-10-2024 01:52
Behavioral task
behavioral1
Sample
726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe
Resource
win10v2004-20241007-en
General
-
Target
726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe
-
Size
63KB
-
MD5
da404026ab952da41d2890c66312e430
-
SHA1
9967ed0ab0e2f97bea5994fc54b4adb11b17e28e
-
SHA256
726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0c
-
SHA512
a5f9e1a6e6dd4773d7f322580590c7dd70f8846596a7d7402f4583568827f215e85d5e1dc016da14d730204e99f57ff90d6fe83efc130056901dffc1aaa6c863
-
SSDEEP
1536:V7Zf/FAxTWoJJ7T3cFMOu/h6HSKX/8KX/FdyGdyH:fny1bcH0
Malware Config
Signatures
-
Renames multiple (3138) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
resource yara_rule behavioral1/memory/2420-0-0x0000000000400000-0x000000000040B000-memory.dmp upx C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp upx C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp upx behavioral1/memory/2420-68-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exedescription ioc process File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core.xml.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_ja.jar.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.resources.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Utilities.v3.5.resources.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\7-Zip\Lang\co.txt.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.contenttype_3.4.200.v20140207-1251.jar.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives_1.1.100.v20140523-0116.jar.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-oql.xml.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Hovd.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\ChkrRes.dll.mui.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\shvlzm.exe.mui.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director_2.3.100.v20140224-1921.jar.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.win32.x86_64_1.0.100.v20130327-1442.jar.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-lib-uihandler.xml.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\7-Zip\Lang\ku.txt.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\deploy.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_ja_4.4.0.v20140623020002.jar.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Mozilla Firefox\firefox.exe.sig.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Royale.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kiev.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Vladivostok.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Helsinki.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Mozilla Firefox\omni.ja.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Client.resources.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Funafuti.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-keymap.jar.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-tabcontrol.jar.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-options.xml_hidden.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Nome.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.RunTime.Serialization.Resources.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\JAWTAccessBridge-64.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montreal.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-options.jar.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Berlin.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Luna.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspatialaudio_plugin.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Manila.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jre7\bin\servertool.exe.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-heapdump.jar.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jre7\lib\zi\Atlantic\Canary.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Darwin.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcfr.dll.mui.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tehran.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations_2.4.0.v20131119-0908.jar.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpclient_4.2.6.v201311072007.jar.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-windows.xml.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_ja.jar.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_zh_CN.jar.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Games\Hearts\es-ES\Hearts.exe.mui.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\HideBackup.bmp.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe"C:\Users\Admin\AppData\Local\Temp\726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2420
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD501a93dbc488b479d68d0ac11f45d3253
SHA154f7b3d6f9402979e14b63fc42bc3f1a53d899c2
SHA2564471e0c0f826135986b8cbe611f52b0e389528d6e9d555d0127eb7be0fd91d74
SHA512d74f602c47ad028e9a04a930fe4cc73e6ecd4e11e08157201590326e978bb151c811aa45fa2dd6b2971023d6cacfdbc87f2b9252635d26333e4387a8f87be206
-
Filesize
72KB
MD5406505908212692ce4683bcc02aeb8ee
SHA1268f726d6a9991694ad40aff12ae6fe18dae82cc
SHA256b8a9c472ed3b936da661c805ffc149cbdd1fc4d9c85e3956e0739caa14f52869
SHA51257c02d1d1f4c88997c1fa63038889dcef5f2c13c2125845e37f9ea5b7ca2e9655e2cebdf35d427e450dc6834fa45095174dd3b36d3a177687b8d2883faba9103