Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-10-2024 00:42
Behavioral task
behavioral1
Sample
1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe
Resource
win10v2004-20241007-en
General
-
Target
1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe
-
Size
43KB
-
MD5
782ad2e90988c8eebd513cacd783ad40
-
SHA1
bc6ead544f4650ea6cd0c988d3a668d053d90acf
-
SHA256
1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbce
-
SHA512
ab132af80d7ecd94c511a1c8fd914d8f42ed5d1c61a748d6bea2f244c7d34c777ec5aad85cb9d053b0603fb17f0f01c6e2585df99e9445121f4cbc4a4a5a797d
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATBZ:V7Zf/FAxTWoJJZENTBZ
Malware Config
Signatures
-
Renames multiple (3896) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2132-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x0007000000012115-2.dat upx behavioral1/files/0x0002000000010674-6.dat upx behavioral1/memory/2132-70-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_ja_4.4.0.v20140623020002.jar.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jre7\bin\unpack.dll.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jre7\lib\ext\sunjce_provider.jar.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyrun.jar.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_divider_left.png.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\settings.css.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cambridge_Bay.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_rist_plugin.dll.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFPrevHndlr.dll.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_SelectionSubpicture.png.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jre7\bin\w2k_lsa_auth.dll.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Belgrade.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\gadget.xml.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Khandyga.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_zh_4.4.0.v20140623020002.jar.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker_1.1.200.v20131119-0908.jar.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\SpiderSolitaire.exe.mui.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libsdl_image_plugin.dll.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Windows Journal\Templates\Shorthand.jtp.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_s.png.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\vlc.mo.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libqsv_plugin.dll.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libscte27_plugin.dll.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\Folder-48.png.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Windows Journal\es-ES\MSPVWCTL.DLL.mui.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\artifacts.xml.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-annotations-common.jar.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jre7\bin\server\Xusage.txt.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pitcairn.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jre7\bin\jabswitch.exe.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Bishkek.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Games\Mahjong\es-ES\Mahjong.exe.mui.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui_5.5.0.165303.jar.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler.jar.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-coredump.xml.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\flyout.html.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\settings.js.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\micaut.dll.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\7.png.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\picturePuzzle.css.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe"C:\Users\Admin\AppData\Local\Temp\1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2132
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD5df4b312f37c9891e101b89466048b1cb
SHA1e5cdc0a19093a64c6bf94cc0813679d3f5541338
SHA256cc4c759b4651598fd80d0d9ed687462ea3cfb496ef2409fd60967db4f0ea77f2
SHA512074811c97fc708f46bd56e4eb8cdcebf71037f9286429c558c3fc35c089e92fef4f8f69198ae21d743e24a55652a563b43784cc7af19ccabf3c7b7a41dcffb4d
-
Filesize
52KB
MD576fc9e45c8cacace287ec240da7ab0d8
SHA1040d62c7be20fb4db2eaa69ca0cd6c7de7366610
SHA256fa8220319f7926c65ccd206fdd0ad6180f1b96b18b75cb82197862b23e5707d1
SHA51215275af14af3efca32379017c2e04476de7d2eca743a057377140ba4ed58b94ec6d476993680ebe1f7d614e8b4561b544f451666d21fe5dec470050988224633