Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
18-10-2024 03:34
Static task
static1
Behavioral task
behavioral1
Sample
d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe
Resource
win10v2004-20241007-en
General
-
Target
d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe
-
Size
95KB
-
MD5
b6939b4e790623ba29424dcd7a57d92c
-
SHA1
0806ec9ef233d21dbd83da882c16a4965d85153a
-
SHA256
d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a
-
SHA512
e92eb0b6f497b396f32008c69c1dafd31302f342241876e2528ecebd9cb584aeeeed2ed3103cf09edb5b3efa995bdd38195482b56c89210245c0b5aa45d28cae
-
SSDEEP
1536:W7ZppApsJNg0tdlAX+zq852d1F4V+kw2tJKSh2hC:6pWpkuK4+bE1F4c2z
Malware Config
Signatures
-
Renames multiple (3458) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exedescription ioc process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClient.resources.dll.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\8.png.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sl.pak.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ja.properties.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_ja.jar.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Java\jre7\lib\fonts\LucidaSansDemiBold.ttf.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Budapest.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.DataSetExtensions.Resources.dll.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libsharpen_plugin.dll.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\27.png.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.bat.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_zh_4.4.0.v20140623020002.jar.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core_zh_CN.jar.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\vlc.mo.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\11.png.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\picturePuzzle.html.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application.jar.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Java\jre7\lib\content-types.properties.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterRegular.ttf.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Majuro.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\console_view.png.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\slideShow.html.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh89.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_ja.jar.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Rangoon.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\liberase_plugin.dll.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_es.jar.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Java\jre7\bin\jsdt.dll.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Java\jre7\lib\deploy\messages_pt_BR.properties.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\picturePuzzle.html.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Shanghai.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Tbilisi.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Currie.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single_orange.png.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\DVD Maker\fr-FR\WMM2CLIP.dll.mui.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_ja_4.4.0.v20140623020002.jar.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Java\jre7\bin\klist.exe.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\DVD Maker\fieldswitch.ax.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Canary.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_ja_4.4.0.v20140623020002.jar.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_ja.jar.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Mozilla Firefox\mozglue.dll.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Windows Media Player\ja-JP\wmpnssci.dll.mui.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\flyout.html.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\weather.html.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_ja_4.4.0.v20140623020002.jar.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_zh_4.4.0.v20140623020002.jar.tmp d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe"C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2716
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD551fdcb8134b118b97dd4c5381e28edf5
SHA1604cdff482e61e98defe29b8a75a52c42c0dd43a
SHA256bfc25c361c77a095454278f11392c45602f4667c9319ece138419e4f0f7c7e63
SHA512452f0be49d3d0778cb4f58ebcd8172bb53b427493c751e60aa822c834fc06137c6d20f3adc7f3462e738dedea4d302a428968722eb95bf5b7c9ec0a07580c978
-
Filesize
104KB
MD522ef3645280c17116ddc567a0cff1a4b
SHA1abef9c84494b4f7115107984915bfaec871f1c58
SHA2567d5699f9b66960bf4b28c4bafb44edaf68ff40a51ea1bf7b994222989fbdc9c0
SHA512b23d50ea90483e5e8f7c0856eac64f71a1fdc18b383f8af875f06bd30347b1693005a4306fdf83a1fce832f1d520b00286f0e9066aac4fd1ca7b02dff9abbc78