Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-10-2024 02:49
Behavioral task
behavioral1
Sample
b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe
Resource
win10v2004-20241007-en
General
-
Target
b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe
-
Size
61KB
-
MD5
74ffee820845401576717cd1d4e5b2d0
-
SHA1
b4f2f674e11a6cc065f62bf3dd6e18716af551aa
-
SHA256
b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735
-
SHA512
bcf842fe48c29061779a3cd58a6a21200a6fbdc0436245bcdf8378a4bd35b0b05c42f09c8899734bc5f0be9a2ef9fdf247549fecd43642287fc32f001c8a0439
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9eEUI0n0uI0n09sg:V7Zf/FAxTWoJJ7TU3n0Wn09sg
Malware Config
Signatures
-
Renames multiple (3208) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2692-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x0008000000012102-2.dat upx behavioral1/files/0x0002000000010621-6.dat upx behavioral1/memory/2692-70-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.ibm.icu_52.1.0.v201404241930.jar.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.actionProvider.exsd.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Internet Explorer\Timeline_is.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Sao_Paulo.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jre7\lib\deploy\messages_zh_HK.properties.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_ja.jar.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-api-caching.jar.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.password.template.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_zh_CN.jar.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Atikokan.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_output\libmmdevice_plugin.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Common Files\System\ado\msadox.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_zh_4.4.0.v20140623020002.jar.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Rangoon.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsBase.resources.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Management.Instrumentation.Resources.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCallbacks.h.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jre7\bin\fxplugins.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Noumea.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata_5.5.0.165303.jar.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_zh_CN.jar.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Dushanbe.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Fakaofo.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.bfc.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Petersburg.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jre7\lib\zi\America\La_Paz.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.properties.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Vilnius.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Kosrae.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Utilities.v3.5.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\vlc.mo.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask_PAL.wmv.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Niue.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_ja.jar.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Microsoft Games\Purble Place\ja-JP\PurblePlace.exe.mui.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsdt.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libremap_plugin.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\7-Zip\Lang\lv.txt.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\7-Zip\Lang\tt.txt.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-execution.xml.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-api.xml.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jre7\lib\security\java.policy.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\vlc.mo.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Rio_Gallegos.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.ja_5.5.0.165303.jar.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\meta-index.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Speech.resources.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.bat.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui_2.3.0.v20140404-1657.jar.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-ui.jar.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tokyo.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe"C:\Users\Admin\AppData\Local\Temp\b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD54059c90394b41eb59bfc5bce102fe4b2
SHA1c25ed37f1b2740721c6ffb78521ce81441778d92
SHA256f35f94a843c7bdd4f75c0f9b446db512875fd9f87353944898107edbc2f82ae5
SHA512964055ee31c1d697295901c1e7194711d2dcee616484079610fadd79a2eae2ff58316c3f9b550b014db91dc9c67c8ad67a28636a2338eab23966a305cef4529f
-
Filesize
70KB
MD53b23809db7711e05f51900fdd7a98c3b
SHA1e44aec25aee2b89bd8064d400bf9dbf08b604d12
SHA2566d19ced14871b5828e7d41f9d7f385805a703f1c9e62e35772f62e9c890b223f
SHA51294858bd2919a634487bb2199cb34d21b1aa859111acb395d706d2aa25a054c37049a5adcce1795107f5da5b0e1b32e57d4b26239f08414b2b40e729048c1d891