Analysis
-
max time kernel
119s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
18-10-2024 03:58
Behavioral task
behavioral1
Sample
42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe
Resource
win10v2004-20241007-en
General
-
Target
42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe
-
Size
59KB
-
MD5
fb6b7e82fedb8c4296e87659acb24860
-
SHA1
f73f041a381233a6800c3c38c15245b6d3ca065b
-
SHA256
42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333
-
SHA512
b53fdb7c66a9e9e6e4458c51152448aa5cb459866f1831b365a57bf6a2221b53e8e7e93ae21bf0c84320597c60e55506fa288d4708170724d2efff1999249808
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/ti0oj1O4iY:V7Zf/FAxTWoJJ7TTQoQ/IE
Malware Config
Signatures
-
Renames multiple (3278) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
resource yara_rule behavioral1/memory/2660-0-0x0000000000400000-0x000000000040B000-memory.dmp upx C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp upx C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp upx behavioral1/memory/2660-74-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exedescription ioc process File created C:\Program Files\Microsoft Games\Hearts\it-IT\Hearts.exe.mui.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\chkrzm.exe.mui.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libvdr_plugin.dll.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\MANIFEST.MF.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkClientCP.bat.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser_5.5.0.165303.jar.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Whitehorse.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InputPersonalization.exe.mui.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_zh_CN.jar.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Amsterdam.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Kabul.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Perth.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\modules\host.luac.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookicon.gif.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-outline.xml.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs-nio2.xml.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Havana.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.bat.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_ja_4.4.0.v20140623020002.jar.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Common Files\System\ado\msadox.dll.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_ja.jar.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt_0.12.100.v20140530-1436.jar.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_zh_CN.jar.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\7-Zip\Lang\cs.txt.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME.txt.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Baku.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jre7\README.txt.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-uihandler.xml.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-bootstrap.xml.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Resources.dll.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\St_Johns.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\uk.pak.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+7.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.properties.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgRes.dll.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kabul.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\7-Zip\Lang\ug.txt.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tripoli.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPOlive.png.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\Office14\NAMEEXT.DLL.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Linq.Resources.dll.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\UnpublishDismount.dotx.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libimem_plugin.dll.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\el.pak.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tarawa.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Istanbul.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe"C:\Users\Admin\AppData\Local\Temp\42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2660
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD583e405022634d5953b27c7709327beb2
SHA13622055489ccdc159da5299f6122f6bbc6cc07d1
SHA256066fe29a528f5dcb7972c8f9adb627ed9f85d888852dc6c8aad0838bd94453d4
SHA512896006cbdc3188b3e04e385a4bdaa5f321253675060c75c60c1ecfb3bea7f3fb94dc9d828f3407eb19a4a14f44c1607634eb293d2fddbc237e589cda92810751
-
Filesize
68KB
MD5d0f06ee91fd5fe60b582d559ba5925df
SHA1133e99fcca3a8072c2d16cdf1989ffab3790f76d
SHA25635b8f9907184cd6a9c6862810c77dc055f001d5c18e49db6067aad4beb661e81
SHA5127275fb17692c65208d31f33f34be48a0d1f3f21fd7b334c68a81a1124c016e58a9aea24094730c4d5d15ef889661ba1de22178db15b3a09a79ab3a21abaca05b