Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-10-2024 03:37
Behavioral task
behavioral1
Sample
efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe
Resource
win10v2004-20241007-en
General
-
Target
efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe
-
Size
55KB
-
MD5
0c855112ecd43d019fa367d931c2d021
-
SHA1
b65d049651d30f25f08719fc25ee2fc72a75560b
-
SHA256
efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178
-
SHA512
affb03f16606f833ffa3c5240df92badfd1f07ec11b5f5565ccb599dd3015a5b84f71e34a856431cbc445e746285bc2cd7230f2d382f8ff9a7dc8bd3137dc1bb
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9kd0R:V7Zf/FAxTWoJJ7Tad0R
Malware Config
Signatures
-
Renames multiple (593) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/1656-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x00070000000120fc-2.dat upx behavioral1/files/0x0002000000010420-6.dat upx behavioral1/memory/1656-26-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\glib-lite.dll.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\msinfo32.exe.mui.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Common Files\System\ado\msado20.tlb.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sl.pak.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_ButtonGraphic.png.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\eula.dll.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\sawindbg.dll.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Internet Explorer\ieproxy.dll.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\7-Zip\Lang\is.txt.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Common Files\System\msadc\handsafe.reg.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\1047x576black.png.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipTsf.dll.mui.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Notes_PAL.wmv.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfxrt.jar.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\7-Zip\Lang\ga.txt.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\DVD Maker\es-ES\OmdProject.dll.mui.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsdt.dll.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\7-Zip\7z.dll.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png.tmp efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe"C:\Users\Admin\AppData\Local\Temp\efc94de13fd08da008fa80441742090e6042bca3b968905086cb599aa36eb178.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1656
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
55KB
MD5e494aaf55bc44bb8695063b2ee8b68f9
SHA15512a704ab7608d507d47075eaa1acf82f87f2d9
SHA256cb0d5a6b4a29866edd172aef60257e83f5b39bf696f38e0dc99646c220eb4923
SHA5129c0f47fef4656733603671888f637f7d3149dd5618d7aae7f64dd57a57a86af673928fbb8bd647700772b8a0ff8f4a9f841f9021cb16536a137d53a3868a4c4e
-
Filesize
64KB
MD53b476ffed8cd15f12cea8a050f41d33a
SHA1834099449d08137be3e960e3a3785dbc2635572e
SHA2569b6a8cbe40043b53e8b970d0bedd88f535a3367b183fdd8d23828d33450f092e
SHA51207be5891c3f63d05097423d5d7c0e2e456c73f8a97295e8f738c1cd6339593c751496cfc8790c1616178a6210f98ab2c64c236c2d91687915c67d0a9e37280e0