Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/11/2024, 23:55
Static task
static1
Behavioral task
behavioral1
Sample
fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe
Resource
win10v2004-20241007-en
General
-
Target
fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe
-
Size
64KB
-
MD5
5b072bfba9e4f68225aab2ece0b9c3d0
-
SHA1
b26e1f70a8af91f8fabf191b8b8b8d11633885b7
-
SHA256
fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252fa
-
SHA512
435a3bb81e4f39f8073d8bc6546f60a2f4030a6d414d5f641be70554b43d88fbbe7c6036dbebdf2aa14a7f539efeb40d7760aaeb0a1e06fb986e8b3177e7275a
-
SSDEEP
768:W7BlphA7dASbS7EXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKeX:W7ZhA7dAynMdyGdy7YRY1tvtmZf
Malware Config
Signatures
-
Renames multiple (3297) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\ext.txt.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\file_obj.gif.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_ja.jar.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\vlc.mo.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_zh_CN.jar.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-uihandler.xml_hidden.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\com.jrockit.mc.console.ui.notification_contexts.xml.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.runtime_0.10.0.v201209301036.jar.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_ja.jar.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ho_Chi_Minh.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.event_1.3.100.v20140115-1647.jar.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_ja_4.4.0.v20140623020002.jar.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_olv.css.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\colorcycle.png.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\license.html.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-process-l1-1-0.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\ConnectProtect.xlsm.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_ja_4.4.0.v20140623020002.jar.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Jerusalem.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-snaptracer.xml.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Xml.Linq.Resources.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application-views.jar.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Singapore.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Mozilla Firefox\browser\crashreporter-override.ini.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\bandwidth.png.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_zh_CN.jar.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\jfluid-server.jar.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Brisbane.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Martinique.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Manila.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Microsoft Games\FreeCell\es-ES\FreeCell.exe.mui.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\sawindbg.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Magadan.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Athens.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Common Files\System\ado\msadomd.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ru.jar.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Linq.Resources.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_av1_plugin.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\MSTTSLoc.dll.mui.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\dcpr.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Microsoft Games\Chess\ChessMCE.lnk.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Printing.resources.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationFramework.resources.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_zh_CN.jar.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jre7\lib\cmm\sRGB.pf.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libmft_plugin.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tokyo.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME.txt.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe"C:\Users\Admin\AppData\Local\Temp\fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2712
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD500be2a40302407715565914d2aee1050
SHA1ad1e8d2173929f10479c867bf47d8d017d7aa2cd
SHA256f6b531f8cd4c1b22fb63e6904526426ab5ecb5c1badb66442754e124b15f744a
SHA512704ed32d3f1b0a192b10c6045a8cca51d1289bbba4bfd832ad2bd9612edc1febc155d89c0127eb55db838eefa9912134cbb62255e0bfdae56a06f5c0d4c3d141
-
Filesize
73KB
MD5203e6b242b17670d02f096dcd9579644
SHA14239401bdec0831c48d4066090203d96339411a9
SHA2562181984ba869cb76ffd955433fac1167c1c17e33b59065019c6f0fc39ca0700c
SHA5129870e295a31fe9438ec4866df6a488eb688161bc45d3e8c465510dcf8401b038018972385b94c01f53a0465a72f7bb1c9d92c80ced5be3927cad65e68e0689eb