Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-10-2024 02:28
Behavioral task
behavioral1
Sample
5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe
Resource
win10v2004-20241007-en
General
-
Target
5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe
-
Size
64KB
-
MD5
8294f5cdfbfe0f303d0464f6cda77f50
-
SHA1
c8b491e041cd271651c6adb8a83618ef265fea4f
-
SHA256
5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68beb
-
SHA512
a7d334a1c7de628a8515e6d929f8bf5d4b901c0bbfa17a029b16aea53b8925c975326d4367a5cd45a2b1296f90ca0add8edd052572fb9c1d70883f7e8d8cc39b
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9eEvCsZCsWQetQe7:V7Zf/FAxTWoJJ7TUcdWXtX7
Malware Config
Signatures
-
Renames multiple (3242) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2364-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000b000000012029-2.dat upx behavioral1/files/0x000400000001043d-6.dat upx behavioral1/memory/2364-74-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.properties.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util_1.7.0.v201011041433.jar.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\7-Zip\Lang\da.txt.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_zh_4.4.0.v20140623020002.jar.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-outline_ja.jar.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_zh_CN.jar.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Lagos.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Design.Resources.dll.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_it.properties.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuala_Lumpur.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Berlin.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_zh_CN.jar.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libsmb_plugin.dll.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Internet Explorer\en-US\F12Resources.dll.mui.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_zh_CN.jar.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring.jar.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\7-Zip\Lang\he.txt.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr.jar.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-attach.jar.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm.xml.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Internet Explorer\jsprofilerui.dll.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_HK.properties.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-snaptracer.xml.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jre7\bin\jp2ssv.dll.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Blanc-Sablon.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Chuuk.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tehran.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rightnav.gif.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG.wmv.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Chatham.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkWatson.exe.mui.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jre7\lib\security\java.policy.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonSubpicture.png.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\alt-rt.jar.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-core-kit.xml_hidden.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Beulah.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libstl_plugin.dll.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator_2.0.0.v20131217-1203.jar.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-execution.xml.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-options.xml.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-plaf.jar.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guam.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\blafdoc.css.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-spi-actions.xml_hidden.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Xml.Linq.Resources.dll.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist_jstree.xml.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe File created C:\Program Files\Java\jre7\bin\msvcr100.dll.tmp 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe"C:\Users\Admin\AppData\Local\Temp\5e6e5bda201c8008699fe4d5ca5ad183378165a80443282f1f8a9ecdadc68bebN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2364
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5d4fde82e3f7eb785b86b9d877f9a81d6
SHA18d9479b385be7574ecf665a91e78b5956fe0dfe7
SHA256e644741f19882ab3e3bfa4efebbdcc748402212b59b30f82fe2e04975e687326
SHA5127041f6cd54b4cd927d236885682aba17e67145d8eb1778b4649920526260189c0afb82d5f7cd6e5538df1ca09a204295026ae8ff88b08c03a924b561ca3f2a87
-
Filesize
74KB
MD5a8d9ee3ee4caee2f4d556569d2b357a3
SHA1a2a19c47e6e175e543211d6e72ef8ac997978f38
SHA2564e5bbc6d27ba50eff82bddeaecc4a9757124024b9138d5a9e279018fe450455c
SHA512dc6fb43e29c742e64472ce2d392850aee1151b0115d534d035ea1e57fa8c2ff827befa1655bd74d3f9b7c32bacd2ea69d63f280d9ccc1ffc5fbc9d3d553bf047