Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
20-10-2024 01:29
Behavioral task
behavioral1
Sample
f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe
Resource
win10v2004-20241007-en
General
-
Target
f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe
-
Size
96KB
-
MD5
7adc5ab8a091a35785d3e8f1158d42f0
-
SHA1
f4b71f89f2e26f8199f34eb0a222323e8843da24
-
SHA256
f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38
-
SHA512
b209389544d4cb32f372d2c86d61bb332c8fefdfcf8474a2ee158b0414eb8acde12ad0b1bd8bf64e13d43e6eb7f792ee19f6db4b5231a731e9736584016ee8a0
-
SSDEEP
1536:a7ZyqaFAlsr1++PJHJXFAIuZAIuXsJtLJtU:enaym3AIuZAIuXj
Malware Config
Signatures
-
Renames multiple (3057) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2120-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000e00000001418b-2.dat upx behavioral1/files/0x0002000000010485-6.dat upx behavioral1/memory/2120-70-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mip.exe.mui.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jre7\bin\jfr.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Santa_Isabel.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Rarotonga.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\ShvlRes.dll.mui.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Resources.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\7-Zip\Lang\ta.txt.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbytools.jar.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\WET.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet.jsp_2.2.0.v201112011158.jar.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mac.css.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.security.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Microsoft Games\Hearts\desktop.ini.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-progress-ui.xml.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Tunis.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\ShvlRes.dll.mui.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\javafx-mx.jar.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.xml.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_ja_4.4.0.v20140623020002.jar.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Havana.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Tegucigalpa.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.css.sac_1.3.1.v200903091627.jar.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jre7\lib\psfont.properties.ja.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives_1.1.100.v20140523-0116.jar.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_zh_4.4.0.v20140623020002.jar.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Sofia.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\7-Zip\Lang\tk.txt.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.properties.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_zh_CN.jar.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-settings.xml.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Kiritimati.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Microsoft Office\Office14\Mso Example Setup File A.txt.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-remote.jar.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\rtscom.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Fortaleza.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Managua.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_ja.jar.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Internet Explorer\perf_nt.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\La_Paz.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host.xml.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator_3.3.300.v20140518-1928.jar.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring.jar.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_zh_CN.jar.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jre7\lib\zi\WET.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe"C:\Users\Admin\AppData\Local\Temp\f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2120
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD5262cd5de93ffda1ef48a80f975843a01
SHA1d4eaca07b1f3fb4e98a4cb2a3a0e5404621fb70b
SHA2561ab0a17ad918677c99d027f11aed20e4d84ca557bff0aa544e12c6ed3bb15bf1
SHA512c5036d5189cc55ce372335b7bab2b1fed3f7cb9c202e3adfa41b6fe110020fd1bb2615feab645be8acef98bdf0d6676e16d263b28dc25b26b91a8d22bc2fae77
-
Filesize
105KB
MD505f041ee9e3889feff07263a95bcf28f
SHA17a6c58c3b3c330db2482619ee728e8d7e451f8ba
SHA2568bd7d7e88a6223eb651ca8e6670b6c0a886e690fef6a0fd717afc64f55c6b5ef
SHA512ac7e74c0d5cada7fd8d9984aeb2a9b2e413a61bf2412cc0297d8df9c1f5f5c01305e3272cb1585ab87729c422dda732a52a77e3c87a3cc4c1a3a28b43d49a1f5