Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-10-2024 01:47
Static task
static1
Behavioral task
behavioral1
Sample
390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe
Resource
win10v2004-20241007-en
General
-
Target
390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe
-
Size
54KB
-
MD5
023e27e6293794293a40378341c0b2f0
-
SHA1
c94c323b4f528c6e16bc5726561637bf66f820b8
-
SHA256
390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58
-
SHA512
d0e02902f65db62e6c867acc8921da262efe44e97d0f4101cf65b96975ddc0df22e4fe3962c598e9bd627202073fd2966704f3f80e581d6c920e881cc3660dcd
-
SSDEEP
768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lsSThlEieBXEieBr:W7ZhA7pApM21LOA1LOl6vSjPWXPWr
Malware Config
Signatures
-
Renames multiple (3715) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Games\Mahjong\ja-JP\Mahjong.exe.mui.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClient.resources.dll.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\XDPFile_8.ico.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\tzmappings.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_zh_CN.jar.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.dll.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial.png.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Miquelon.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app_1.0.300.v20140228-1829.jar.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\bckgzm.exe.mui.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\2.png.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_partly-cloudy.png.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-last-quarter_partly-cloudy.png.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.xml.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libkate_plugin.dll.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Windows Media Player\de-DE\mpvis.dll.mui.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\ChkrRes.dll.mui.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\hint_down.png.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\setup.swf.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kosrae.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Simferopol.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Auckland.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\dummy.luac.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Windows Journal\MSPVWCTL.DLL.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev-down.png.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Adak.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system.png.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\settings.js.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\7-Zip\Lang\ko.txt.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pitcairn.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_smem_plugin.dll.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Windows Defender\ja-JP\MpEvMsg.dll.mui.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Internet Explorer\en-US\jsdbgui.dll.mui.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_ja.jar.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Mozilla Firefox\browser\features\[email protected] 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\SkipProtect.mhtml.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libopus_plugin.dll.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\RSSFeeds.js.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\slideShow.js.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh89.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Microsoft Games\Chess\Chess.dll.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-charts.xml.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\7-Zip\Lang\sq.txt.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\manifest.json.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-util-lookup.jar.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_zh_4.4.0.v20140623020002.jar.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_ja_4.4.0.v20140623020002.jar.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Microsoft Games\Hearts\es-ES\Hearts.exe.mui.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\vlc.mo.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\7-Zip\Lang\kk.txt.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe File created C:\Program Files\DVD Maker\soniccolorconverter.ax.tmp 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe"C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2520
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
55KB
MD5b4f33c0efac6252308ca8d1c07e9f78e
SHA1e98d4269345b5a348f20abdc552939462de75a86
SHA2569b0e4dce4c0d1647856ec4d3230ced01cb8e074c5e147b4249c4c28ccfb9aa57
SHA512be776ab38d1df7fc52d6fbec43bda63efc8982c0a9b696e65464b52f2cfd75f01ad02dbb2f7868deb230cd23e608a17e83ce61b1f4deedbb44d2536586961ed6
-
Filesize
64KB
MD57577004dcf70385ac0bb033061203596
SHA1675730130ec12291e33caacd49d5a6dbf8508c41
SHA2564903fe46027fe17f04b6c7fb72e2401ca9cfcb08073214305d749de08b74f728
SHA512bad69a6c36ebb90c699f15d5878586e360fda0ad989cc31cc95287f9b796d385e6e9c0fecf41da4fcd2c17d6cb4532a5c4f18210d31d6a67fd430492ea596eaa