Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-10-2024 02:55
Behavioral task
behavioral1
Sample
7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe
Resource
win10v2004-20241007-en
General
-
Target
7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe
-
Size
39KB
-
MD5
eaf5b6b958b26ca5c40eccbef70f7f10
-
SHA1
1ba7c970629e8e9a8202410792f3e8807056e92f
-
SHA256
7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fc
-
SHA512
c7446c1d822d1b93e633089cde1a92ed2ef7a0af1ffe2d250349d5597342b54fdc04f1aafaa87fa99db500f6d2ad4d8f8b089791536244ef23b95fba1641648a
-
SSDEEP
768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9Ro+QOViJfo+QOViJEopodSox/6Sox/9K:CTW7JJ7TPUTEu
Malware Config
Signatures
-
Renames multiple (3941) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
resource yara_rule behavioral1/memory/2528-0-0x0000000000400000-0x000000000040A000-memory.dmp upx C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp upx C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp upx behavioral1/memory/2528-70-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exedescription ioc process File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-over-select.png.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.metadata.repository.prefs.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Cairo.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-3.png.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bg.pak.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClientsideProviders.resources.dll.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\vlc.mo.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\msvcr100.dll.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\high-contrast.css.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_ja.jar.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Windows Defender\de-DE\MpEvMsg.dll.mui.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Windows Sidebar\fr-FR\sbdrop.dll.mui.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\timeZones.js.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Khartoum.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-heapwalker.xml.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Microsoft Games\Mahjong\it-IT\Mahjong.exe.mui.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_ja_4.4.0.v20140623020002.jar.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_ja.jar.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Java\jre7\README.txt.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_bridge_plugin.dll.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Stars.jpg.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Bermuda.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Java\jre7\bin\net.dll.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Windows Media Player\es-ES\wmplayer.exe.mui.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ACERECR.DLL.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Windows Journal\ja-JP\jnwdui.dll.mui.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.zh_CN_5.5.0.165303.jar.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Microsoft Office\Office14\VisioCustom.propdesc.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\vlc.mo.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\liblogger_plugin.dll.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Windows Defender\MpOAV.dll.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\settings.js.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Java\jre7\lib\zi\Atlantic\Cape_Verde.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Mozilla Firefox\ipcclientcerts.dll.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Mozilla Firefox\nss3.dll.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libpva_plugin.dll.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\settings.js.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Marquesas.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\shatter.png.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Melbourne.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.metadataprovider.exsd.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Nome.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libscte27_plugin.dll.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Windows Journal\Templates\Music.jtp.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedShuangPin.txt.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_ja.jar.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Java\jre7\lib\cmm\PYCC.pf.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.DataSetExtensions.Resources.dll.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InputPersonalization.exe.mui.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_zh_4.4.0.v20140623020002.jar.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-core-kit.xml.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Java\jre7\bin\splashscreen.dll.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Windows Journal\it-IT\Journal.exe.mui.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_preferencestyle.css.tmp 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe"C:\Users\Admin\AppData\Local\Temp\7b32b65b25594ae7b562f72974fef7a7a432e588b694aa4e097352823a05e2fcN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2528
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD531326ed9e6c0e37b8884eccbc8ea4de3
SHA1c7050d34e3f6a7fbd88fd1d88dc5ce3243b366b9
SHA256b9bc4182b889f0c2fd05656b1557d6253b7a99c39a7c9515e1da69d38b4d01da
SHA5127aee0e4c48a2e72e6eeeb0da42670a7b6f9f99921277c9626411395863b240dcda61be1b3f3f06840c9ffc6205d5c20bd8e6518782f02d1f10b1d98da5124235
-
Filesize
49KB
MD5c6e70211ef9f25629e08833a54d981d9
SHA1333ca3de1a49421c80db699ecd620c97ee5ab4cb
SHA256781411da60c379565386ab30490b721d721616f644defa4dfb1a109d56b9ffd2
SHA51292faba6087644db215f7c855e7459d15367623da28852b9c327f0ba352ba89274d7a86bcccf4c1561bec5df126c98ad4800c31cad6b70a7cfa14e8ad65019adc