Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-10-2024 03:12
Behavioral task
behavioral1
Sample
19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe
Resource
win10v2004-20241007-en
General
-
Target
19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe
-
Size
31KB
-
MD5
b80cd31087452fd3015c08670a167780
-
SHA1
7e5d4bb1d1af7797422c206720ed4a4cd851d13a
-
SHA256
19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230
-
SHA512
e530fc7f6189bf3f6bc8a6d804b5d07a9216a53c0106a5329dd308231d8f0e747104fd1fee1bd49534a18e595c1528f88cde626c6608d36f70298f2f4af00a16
-
SSDEEP
768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9woOzOuiJfoOzOuiJNaI9aIOt:CTW7JJ7T4MFt
Malware Config
Signatures
-
Renames multiple (3250) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2524-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000c0000000122ce-2.dat upx behavioral1/files/0x0002000000010621-6.dat upx behavioral1/memory/2524-70-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxmedia.dll.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pontianak.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-fallback.xml.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\updater_zh_CN.jar.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvm.jar.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Denver.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Mozilla Firefox\osclientcerts.dll.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\VideoLAN\VLC\lua\http\vlm.html.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Microsoft Games\Purble Place\fr-FR\PurblePlace.exe.mui.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-views.xml.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcfr.dll.mui.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\com.jrockit.mc.console.ui.notification_contexts.xml.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sig.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IdentityModel.Selectors.Resources.dll.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-api.xml.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jre7\lib\calendars.properties.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Oslo.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\el.pak.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jdk1.7.0_80\include\jni.h.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\vlc.mo.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\topnav.gif.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-ui.jar.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jre7\bin\ssv.dll.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jre7\lib\sound.properties.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIcon.png.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rio_Branco.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.runtime_0.10.0.v201209301036.jar.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-stdio-l1-1-0.dll.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\VideoLAN\VLC\plugins\d3d11\libdirect3d11_filters_plugin.dll.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground_PAL.wmv.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunec.jar.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multiview.xml.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Cancun.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jre7\bin\dcpr.dll.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jre7\lib\ext\access-bridge-64.jar.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Cuiaba.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-spi-actions.xml.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Jerusalem.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\vlc.mo.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tabskb.dll.mui.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Paramaribo.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Sakhalin.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Vostok.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\7-Zip\Lang\fa.txt.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libnsc_plugin.dll.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.ja_5.5.0.165303.jar.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.resources.dll.tmp 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe"C:\Users\Admin\AppData\Local\Temp\19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2524
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD5a07aa9c2c9684f621e3a6dc91884f441
SHA1bb5f2e5691acbed7bcdd3577fde5f79a57217b38
SHA25658c55c41bddfaeb638f810009717caf4de02e188d29db56f9a236ba022239729
SHA512034cea08b2e498d1cae75777f0af87f3f2cbc82a2d0ed42e514c9f1a79a30e18dc3cc2e93967c6a4a9b0201bb88ece921a8458ef4c8b81b7e7d2ac44d41ad3a1
-
Filesize
40KB
MD58b70eef25f2dee009d2a77b07c0bec09
SHA1079a8398840792e394b204d2bd9f81c027b984fe
SHA256eee63e9d4b2f59f522cf2c8f15cb84e55cb51a265dfcd31532b18435006a3d40
SHA5129206cb53cbe545b845c3b22db25ee790c5fb5faf8fbcdd55ab21e9c6c87da9bcdf0bce7cbbbb700ed882fffdfdd5590141339851520d8891a04624d63f2711af