Analysis
- max time kernel
120s - max time network
119s - platform
windows7_x64 - resource
win7-20241010-en - resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system - submitted
19/10/2024, 17:06
Behavioral task
behavioral1
Sample
4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe
Resource
win7-20241010-en
windows7-x64
4 signatures
120 seconds
Behavioral task
behavioral2
Sample
4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
120 seconds
General
- Target 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe
- Size 27KB
- Sample241019-vmlt3axble
- SHA256 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfa
- MD5 5bdc2f5631e80aa38c0dec956cd40c10
- SHA1 f989a132e7c610cecdca7001b73068b6150cd661
- SHA512 7f27bddae2f5e3c38d663e9a728eeed1ee7fb0e35cdacb9674529067519536206cc92ae72390f9138c3672166b369a25061cc2743282a9eafc7aae1b93309d75
- SSDEEP 384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9qQA/9i:kBT37CPKKdJJ1EXBwzEXBwdcMcI9Y9i
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (3360) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2136-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x00090000000120f9-2.dat upx behavioral1/files/0x0005000000010479-6.dat upx behavioral1/memory/2136-70-0x0000000000400000-0x000000000040A000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Kiritimati.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libspeex_plugin.dll.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-print.xml.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\chkrzm.exe.mui.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\liveleak.luac.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_filter\librecord_plugin.dll.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbytools.jar.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.ja_5.5.0.165303.jar.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_ja.jar.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\PingSubmit.ttf.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Internet Explorer\en-US\iedvtool.dll.mui.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Cayenne.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Mozilla Firefox\msvcp140.dll.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port-au-Prince.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_ja.jar.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\dt.jar.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vevay.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Microsoft Games\Chess\it-IT\Chess.exe.mui.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\shvlzm.exe.mui.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libdav1d_plugin.dll.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.properties.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-settings.xml.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Eirunepe.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jre7\bin\fxplugins.dll.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations_2.4.0.v20131119-0908.jar.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.properties.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Santo_Domingo.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\DVD Maker\Eurosti.TTF.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Internet Explorer\ie9props.propdesc.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Marengo.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_ja.jar.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+7.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcfr.dll.mui.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.ja_5.5.0.165303.jar.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Microsoft Games\Hearts\fr-FR\Hearts.exe.mui.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector_1.0.200.v20131115-1210.jar.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Printing.resources.dll.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\vlc.mo.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.commons.codec_1.6.0.v201305230611.jar.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_mainImage-mask.png.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Maceio.tmp 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe"C:\Users\Admin\AppData\Local\Temp\4bad464283e0d17329c67e76c83508049da72cca27ed93fe86aebc3b8ec68cfaN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2136
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2039016743-699959520-214465309-1000\desktop.ini.tmp
- Size 28KB
- SHA256 4f2782a9de3af7be1e4ee3abee4492671db93dd27af5018317d9e126f4852493
- MD5 182a4bdd55c761f120b47229c82b2252
- SHA1 2802b39639c6b95340de30b5ef44f917330fecd2
- SHA512 ab476586b23262bde09fbb5e3d7daa6a31ca31fe9b9c7c9d553cd07334f81ead3d7740d78970c72cbf79067ca505b618bf428f381a8a4f70265b77ba708bb699
- SSDEEP 384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9qQA/9L:kBT37CPKKdJJ1EXBwzEXBwdcMcI9Y9L
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
- Size 37KB
- SHA256 482d399dc4d44008c15c9ffaf31fa3d149e8c64570696eb689f7be68b8b41ffa
- MD5 d99466c339d3ef3614a5f2ec33bc0a61
- SHA1 c3a2fa2c7e868f377036543785b5747cfd767817
- SHA512 bad85d11d77ca0bb99d602207e0293cf30d7b56d67b0c4e5876ead6ba96c94da427175292c5e1fe0a31affce69b9c6e3f85e0c35a0033b7e1ed0bf14b5cb4aa6
- SSDEEP 768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9Y9bN1J3DCl4N1J3DClH:CTW7JJ7TB
- MD5 SHA1 SHA512 SSDEEP