Analysis
- max time kernel
120s - max time network
118s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
23/10/2024, 05:15
Behavioral task
behavioral1
Sample
a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
120 seconds
Behavioral task
behavioral2
Sample
a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
120 seconds
General
- Target a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe
- Size 27KB
- Sample241023-fxjp5avanj
- SHA256 a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120
- MD5 82ffb152083d569875943e9d4d42d890
- SHA1 81d68357c00cd5f6f5df463cab01ae0f53113fb7
- SHA512 616b680c4b563c8ca463a5a76e46ebfc68ca0e0c4b3bc60c90ae7d70819fc376192995ebd51695fc383a975c16e3bea4851c452fc6408c66582a266522003898
- SSDEEP 768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATB2:CTW7JJZENTB2
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (3461) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/1724-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x00090000000120f1-2.dat upx behavioral1/files/0x0002000000010664-6.dat upx behavioral1/memory/1724-75-0x0000000000400000-0x000000000040A000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Windhoek.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Copenhagen.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.properties.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.access.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-search.xml.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-templates.xml_hidden.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Niue.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+7.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwresslm.dat.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Internet Explorer\Timeline_is.dll.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\MANIFEST.MF.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_ja_4.4.0.v20140623020002.jar.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler.xml.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\La_Rioja.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Cayman.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\ReadComplete.aiff.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Makassar.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql_2.0.100.v20131211-1531.jar.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-startup.xml.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-uihandler.xml_hidden.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jre7\bin\JdbcOdbc.dll.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\7-Zip\Lang\ka.txt.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\default.jfc.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Center.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Canary.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Norfolk.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-favorites.xml.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Denver.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Microsoft Office\Office14\MSOHEVI.DLL.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationFramework.resources.dll.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Internet Explorer\ieinstal.exe.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfxrt.jar.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.xml.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_ja.jar.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-core-localization-l1-2-0.dll.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\jawt_md.h.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgradfun_plugin.dll.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\VideoLAN\VLC\skins\fonts\FreeSansBold.ttf.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\7-Zip\Lang\ext.txt.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hong_Kong.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multiview.jar.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe File created C:\Program Files\Java\jre7\lib\fontconfig.bfc.tmp a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe"C:\Users\Admin\AppData\Local\Temp\a580ce442d03d1e84a9d9446b79b4057a4aa3223a708083065459fa8b1068120N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1724
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp
- Size 27KB
- SHA256 f98b1754956b4e538c51c9374197ccadddece97ea253becd3553dcdb40f07502
- MD5 b8e479de93673fd64cccfbc35964f1a4
- SHA1 3020d873726cafae11ef629cc5e76412e421b505
- SHA512 c93dbcfb0a3bbc057d1972a384bea30f1127112bb237c3915f1eee797f57938404900e2e939f5218e330b33fba50917fe018a74aef9d79eca95e813d3d88ff48
- SSDEEP 768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATBY:CTW7JJZENTBY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
- Size 36KB
- SHA256 634febaa9bf66f0ef8b4e46cf77ec9edd878964fae05e757ad0faee8efca6c7b
- MD5 34c9565199eaef1d1cf48fbcf11fb27b
- SHA1 623d9166208d543b0f4bdc5d706a56936168db2a
- SHA512 53376a9287064b3835d1203c3bc0db8e1ed077907b128c4c7b1bfb076610e9905d1a22f8804d342e2933488481340e0aff7e15668936dd934f25f5a4b1cba9d5
- SSDEEP 768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATBbN1J3DCl4N1J3DClV:CTW7JJZENTB6
- MD5 SHA1 SHA512 SSDEEP