Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-10-2024 03:27
Static task
static1
Behavioral task
behavioral1
Sample
ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe
Resource
win10v2004-20241007-en
General
-
Target
ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe
-
Size
71KB
-
MD5
57b5098d87a08e4a2f3b7b29b2953407
-
SHA1
1d6ac278dc6ac882f24dd39efd09e63117d93319
-
SHA256
ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165
-
SHA512
ec4361a5fb1336ee6d8d90186f4aba29dfe4b2b2658574363ed3d9f8644e3e4fb0b79962d94d9c3e92ab11699f9fa233f02234fe97aea0cdc21d449be0a87e39
-
SSDEEP
768:W7BlphA7dASbS7EXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKe8:W7ZhA7dAynMdyGdy7YRY1tvtHrFK0K8
Malware Config
Signatures
-
Renames multiple (3674) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.DataSetExtensions.Resources.dll.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.hyp.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_CopyDrop32x32.gif.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\localedata.jar.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lindeman.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository_2.3.0.v20131211-1531.jar.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_ja_4.4.0.v20140623020002.jar.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Rome.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\8.png.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcfr.dll.mui.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Windows Media Player\WMPNSSUI.dll.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\7-Zip\Lang\ca.txt.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Windows Media Player\WMPDMC.exe.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-ui.jar.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm_cmd.xml.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\VideoLAN\VLC\plugins\spu\librss_plugin.dll.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_ButtonGraphic.png.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\bckgzm.exe.mui.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Mozilla Firefox\mozavutil.dll.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.RunTime.Serialization.Resources.dll.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Windows Journal\jnwmon.dll.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Windows Media Player\es-ES\WMPMediaSharing.dll.mui.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_m.png.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Currie.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Gibraltar.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libadaptive_plugin.dll.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Windows Sidebar\en-US\Sidebar.exe.mui.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_divider.png.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Java\jre7\lib\cmm\GRAY.pf.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\librv32_plugin.dll.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\activity16v.png.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuala_Lumpur.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-visual.xml.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libtcp_plugin.dll.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Windows Media Player\it-IT\WMPDMCCore.dll.mui.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\day-of-week-16.png.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_win7.css.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_zh_4.4.0.v20140623020002.jar.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Currie.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\HST10.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxslt.dll.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-attach.xml.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_plugin.dll.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Windows Journal\it-IT\PDIALOG.exe.mui.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double_orange.png.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_hail.png.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\net.dll.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-dialogs.xml.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Ceuta.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Kathmandu.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Linq.Resources.dll.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tahiti.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\config.ini.tmp ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe"C:\Users\Admin\AppData\Local\Temp\ec5896a605b32f37a6924420745e500aa561d953ea85d3a1f50c4f9d2642a165.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2100
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD51b6abad074ec4d103ba9c87af5eca7de
SHA179f2ca3f0a393f87b059eed762198fe5124b371a
SHA256b8a969ebebecdce2a0e9be239feff087d5faa5a359cb05614e626b85dc16d9b9
SHA512566d4ec8a6586439c23b5cf9115d299e896b4b2d123d65dbe880685dc9e9027b062c263a070e35d895b03d32e86e0bdade7b43911904fc42189d769fc22b2128
-
Filesize
81KB
MD5519c974d786f3e9bf8474b8e3abbb4a1
SHA170c61f1ef569e796c19da4669321ec864fada830
SHA2566fe71f2c30a9814c9385fc0c76f2c0707310ca0142b255d3b831ded1b1e529f7
SHA5127e14b799d364631812bbc861ccb6e2471627aefb598317b3b01a111489c77e4069c1f5076b8a15136ac1252ce07424166e91fe7f1c3eb311c5430c80479b6075