Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
20-10-2024 01:39
Behavioral task
behavioral1
Sample
68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe
Resource
win10v2004-20241007-en
General
-
Target
68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe
-
Size
29KB
-
MD5
b25719682e0c1e0b077751b4e33a7400
-
SHA1
cc097ce3c49a97402950b4da61ad44d727e70b5b
-
SHA256
68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9
-
SHA512
1a4ce4ffe0e4d0f3e2b5404d50ea68d0ce64b80cd8aeb00947542b4eff654a6ae2c55083fa0368beafc6325b18c9846e9098850ee16edeadd365c884ad927303
-
SSDEEP
768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9woOzOuiJfoOzOuiJfy:CTW7JJ7T4MV
Malware Config
Signatures
-
Renames multiple (3795) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2976-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000b0000000120dc-2.dat upx behavioral1/files/0x0002000000010620-6.dat upx behavioral1/memory/2976-70-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_sun.png.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\MSTTSLoc.dll.mui.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.RSA.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Rothera.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Linq.Resources.dll.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\combo-hover-left.png.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_ja.jar.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libstl_plugin.dll.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_description_plugin.dll.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jli.dll.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\jvm.cfg.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tokyo.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticnotification.exsd.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\penkor.dll.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Windows Media Player\de-DE\setup_wm.exe.mui.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile_bezel.png.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Glace_Bay.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Java\jre7\lib\zi\Indian\Chagos.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\liblibbluray_plugin.dll.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_docked.png.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\47.png.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\calendars.properties.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tehran.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Java\jre7\lib\classlist.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\librtp_plugin.dll.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libglwin32_plugin.dll.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libtcp_plugin.dll.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\VideoLAN\VLC\README.txt.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\MSTTSLoc.dll.mui.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jmx.xml.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Kolkata.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\VideoLAN\VLC\COPYING.txt.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Windows Media Player\WMPDMC.exe.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Eucla.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_ja.jar.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Tbilisi.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\ehshellLogo.png.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_zh_CN.jar.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IdentityModel.Selectors.Resources.dll.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\gadget.xml.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Java\jre7\Welcome.html.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libtwolame_plugin.dll.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\gadget.xml.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_s.png.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\gadget.xml.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mip.exe.mui.tmp 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe"C:\Users\Admin\AppData\Local\Temp\68627ee9187ab43c99f8d28d4b888b8f78b2302a350525168b1dd2fac2f60fe9N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2976
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD59352ea659e75b10f271f89cc345f0dc6
SHA11d280d7f1be84e7385703f06b2591f2ff7701a43
SHA25619669553443444b5388b56fc7957d82f8d70a9527f6e81c1bc2f463736b6dfb5
SHA512fc443fc32f48f0d2e2b4fa2a07e2d5145e5bdeef363b9b57f01f1e9afb583a4c4b23ed274b52a3b59fb2e2d7e55840df782e0e51ed10ef5720232392e8d09a7a
-
Filesize
38KB
MD592f594aba5912f3906ddd6eaa7e83592
SHA1c34d1d25c49485604eb8e07c972554d2cda7ba25
SHA256a35a2c73db308864234375254d83815be029ec8e03493f390a21cf0a732d6a92
SHA512749a7123c12910a0ed7636983fe41911585862679a6d755e6b75096f0d41508ca49c97236ac09e7c3c4a4ab51ac234ddf1be9e0169b1d85ee813ac9c1f723c79