Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
20-10-2024 00:36
Behavioral task
behavioral1
Sample
a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe
Resource
win10v2004-20241007-en
General
-
Target
a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe
-
Size
90KB
-
MD5
9c1bfc575995f931e0dd76ce2633e2f0
-
SHA1
7b0120e4ac0a56b58ccd1433783111d43f0bdf77
-
SHA256
a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369
-
SHA512
eb9eb4467b5d587634b36c674f11eb04fad3439723fc19204024f147df8636ef8247b7a744912d743435c9f7a07702a8884f332fa2ac27081963364cdf4332d8
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxY5Kwl:fnyiQSox5Kwl
Malware Config
Signatures
-
Renames multiple (3519) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2568-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000a00000001225f-2.dat upx behavioral1/files/0x0002000000010620-6.dat upx behavioral1/memory/2568-70-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kamchatka.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host.xml.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Java\jre7\lib\images\cursors\cursors.properties.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\40.png.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\7-Zip\Lang\mr.txt.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Common Files\System\msadc\handsafe.reg.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.xml.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\MANIFEST.MF.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_zh_4.4.0.v20140623020002.jar.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\bckgRes.dll.mui.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\librtp_plugin.dll.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\7-Zip\Lang\hi.txt.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jerusalem.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text_3.5.300.v20130515-1451.jar.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_zh_CN.jar.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fi.pak.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.bat.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_zh_4.4.0.v20140623020002.jar.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Microsoft Office\Office14\IEAWSDC.DLL.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClientsideProviders.resources.dll.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\slideShow.js.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\header-background.png.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Tell_City.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-ui.jar.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util.xml.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_es_plugin.dll.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\9.png.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-crescent.png.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_ja_4.4.0.v20140623020002.jar.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Java\jre7\lib\zi\America\Atikokan.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Krasnoyarsk.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\MeasureDisconnect.xla.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspatializer_plugin.dll.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\calendar.css.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Common Files\System\ado\msado28.tlb.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\picturePuzzle.html.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightItalic.ttf.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\MANIFEST.MF.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_zh_4.4.0.v20140623020002.jar.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-fallback.xml.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Adelaide.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\VideoLAN\VLC\NEWS.txt.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Windows Sidebar\it-IT\Sidebar.exe.mui.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single_bkg_orange.png.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\imjplm.dll.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core.jar.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\vlc.mo.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.core_5.5.0.165303.jar.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.ja_5.5.0.165303.jar.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\vimeo.luac.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui.tmp a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe"C:\Users\Admin\AppData\Local\Temp\a35314fcb66859ce9b63724a033a600b0533821ba1ed7da959511a5b0a2bc369.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2568
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD5f25a2cfdc2ebbfa5eacc4a9a271f81d5
SHA148aefa5f26bfdc4ebbd735d05b28b94afc0ea230
SHA256f309ce2a28491c01b4153211ed79fa3e8f7bad12b5ddb4eb0ef93a9b8cc10425
SHA5125effff1770a8a5a70ab5c08969296f5f6ddb00e2bff1808150f7e8ce0b43833d03cad2713991d14cb8beddfa110551ed5a011e4cc69d5d0a6f352832984475a8
-
Filesize
100KB
MD59ff7f755ed7a3081498a810b1e89aac8
SHA1285fbd8b1cd45fbc1aaccd286b8822dba9242364
SHA256bb1416d57f2f889c41fcee554c483833f5549dc09463352d8e162b61174b41b6
SHA5120dafa5d3533ac1a0a54425e1915ce7470caad9f414364cd9e8a15cf59353c9ae9f5ff09999d8a2bcd9136ca7a1a42e58b6e884d946f4fdce753e703fb172e219