Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-10-2024 01:59
Static task
static1
Behavioral task
behavioral1
Sample
58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe
Resource
win10v2004-20241007-en
General
-
Target
58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe
-
Size
48KB
-
MD5
533d643c85ef67d52eae7867d4e195c0
-
SHA1
d4e1ccd0d2294f1b5685add5d4e4bd3bcf14f17e
-
SHA256
58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2
-
SHA512
f6c113942d723fb1b232acb766e0b3fe7584e0b897f92c6c4bc2f2860b77f7b5f60ef94eb60fab7c148381aceed1fed897babb6f12b85606a31e268ce21ab679
-
SSDEEP
768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lsSThF:W7ZhA7pApM21LOA1LOl6vSb
Malware Config
Signatures
-
Renames multiple (3181) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre7\lib\ext\sunmscapi.jar.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.properties.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-javahelp.xml.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-loaders.jar.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mru_on_win7.css.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Mozilla Firefox\defaults\pref\autoconfig.js.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rankin_Inlet.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\oracle.gif.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-io-ui.xml.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.RunTime.Serialization.Resources.dll.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libstereo_widen_plugin.dll.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Resources.dll.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-options_zh_CN.jar.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\status.json.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Darwin.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.contenttype_3.4.200.v20140207-1251.jar.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jre7\bin\sunec.dll.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Ho_Chi_Minh.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libaudiobargraph_a_plugin.dll.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Madeira.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Araguaina.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_zh_4.4.0.v20140623020002.jar.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_ja.jar.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Beirut.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.ServiceModel.Resources.dll.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Monrovia.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Speech.resources.dll.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Fakaofo.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Linq.Resources.dll.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_zh_CN.jar.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-services.xml.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Internet Explorer\DiagnosticsHub.DataWarehouse.dll.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticattribute.exsd.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ms.pak.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterRegular.ttf.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-core-processthreads-l1-1-1.dll.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsFormsIntegration.resources.dll.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\7-Zip\Lang\an.txt.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\MSTTSLoc.dll.mui.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodicon.gif.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-execution_ja.jar.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-api.xml.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Management.Instrumentation.Resources.dll.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi_3.10.1.v20140909-1633.jar.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Net.Resources.dll.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui.tmp 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe"C:\Users\Admin\AppData\Local\Temp\58c40bb060bc7271af5b1ad8ffb93314a0b5149f2af4e3aa12fe08f2212493f2N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2112
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5ad6ba7b1bfee842e1e2e430a3007bb1d
SHA17d170a4393525ae431550d192bcebfd69468856e
SHA256a356372fb924b0c9b0175912741e22e8ee0bf6531924c5ac6aa1144448f81dd7
SHA51213db172cafe51f2ebc16149ae9eac30e7f451b5897b44b5ea4e192bd194981b713f3069c0cb9afacee49012e86060716205cc9adef0e0dfa65e9dead5d92180c
-
Filesize
57KB
MD59092da63c0de04a36e4d2346e63d32ca
SHA1075a9266202903beb89c2848280390ed5cead399
SHA256accd3ee268f80c5f0a2dfb7f1d3fcefc2914b78233e2e15494945f1ae8e3beb4
SHA5127bf21959a53dfeda7fb9303bf31a3dd2923f16a3ab549e8e13f9b744a13fd424b244b0a7b45c4b1ee5874ec773b4b09219b6332457a999ada1b43154c6971375