Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-10-2024 03:27
Static task
static1
Behavioral task
behavioral1
Sample
3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe
Resource
win10v2004-20241007-en
General
-
Target
3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe
-
Size
56KB
-
MD5
788b975223e3a4bea328f2c8bea0a280
-
SHA1
3129fabb60b2787c963110406583a0c1885b032f
-
SHA256
3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384
-
SHA512
655655bb7cc48891f0126972b79e277abcacbb37f6bad4b6adff8f6458bba0f30a17b10e69ffa91130827649ecb69e495c0f456caa18d154dd6f62cb0ec8e26b
-
SSDEEP
768:W7BlphA7dASbSjJJcbQbf1Oti1JGBQOOiQJhATNyQYCpCPzzgpQZ+zzgpQZ+TQp7:W7ZhA7dABJJZENTNyQYCpCP44sjTj64R
Malware Config
Signatures
-
Renames multiple (3635) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pyongyang.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+1.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_ja_4.4.0.v20140623020002.jar.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Bougainville.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Windows Journal\de-DE\Journal.exe.mui.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr.jar.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-ui.jar.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationBuildTasks.resources.dll.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_top_left.png.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\10.png.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Net.Resources.dll.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_dummy_plugin.dll.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Windows Journal\es-ES\MSPVWCTL.DLL.mui.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_snow.png.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Microsoft Games\Purble Place\de-DE\PurblePlace.exe.mui.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\vlc.mo.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\VideoLAN\VLC\plugins\gui\libskins2_plugin.dll.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\settings.html.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\weather.js.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Internet Explorer\iexplore.exe.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util.gui_1.7.0.v200903091627.jar.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt_0.11.101.v20140818-1343.jar.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\MCESidebarCtrl.dll.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\7.png.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_SelectionSubpicture.png.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\w2k_lsa_auth.dll.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_ja.jar.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-attach.xml.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Microsoft Games\Hearts\de-DE\Hearts.exe.mui.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\RSSFeeds.js.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\br.gif.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Java\jre7\lib\zi\Indian\Kerguelen.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_rist_plugin.dll.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\DVD Maker\Eurosti.TTF.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Java\jre7\bin\ssv.dll.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\gadget.xml.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\decora-sse.dll.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_ja_4.4.0.v20140623020002.jar.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Port_of_Spain.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libschroedinger_plugin.dll.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Windows Media Player\es-ES\WMPDMC.exe.mui.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-print.xml.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\Indianapolis.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Recife.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirectdraw_plugin.dll.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\meta-index.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\jconsole.jar.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_ja.jar.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_zh_CN.jar.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\init.js.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\gstreamer-lite.dll.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_ja.jar.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationTypes.resources.dll.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)alertIcon.png.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe File created C:\Program Files\Internet Explorer\DiagnosticsTap.dll.tmp 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe"C:\Users\Admin\AppData\Local\Temp\3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2416
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD51716b79fd13fa113dcf7dba1738b1f28
SHA128f18e87cc7049ba8c0996a7d223d0518d958277
SHA25616bf2338a4a3166780de50778359516193becbbc90a9ef2826931321948b93a1
SHA51230e22eece72a722cbaf14db0dbef4f931d300aa5b616c984efd9da5809596cd365e8c379405c3cf7674fc9e637015f0ad8c5dd50c3577ad697f5278474ee4c04
-
Filesize
65KB
MD54a35858a65d94b0344b33d96bf30724e
SHA1e7b67e08166af761a13b1a2e4012af39da91ca37
SHA256f2df22c37d609922403bd34431f1c206065e13a1552dbfc6ee63bcfbd9744c4c
SHA512d209e1d2334172153207dd633f09c79e9eae97620bdaab7ee32e2359d7913401e05942bb119d4d7de5961f33f1c6c3b64bc409bf1a96570ae9e89634965dc67c