Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/11/2024, 01:42
Static task
static1
Behavioral task
behavioral1
Sample
6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe
Resource
win10v2004-20241007-en
General
-
Target
6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe
-
Size
93KB
-
MD5
2c16e3e458f7feb4bda30811c953b490
-
SHA1
baad33703b5d3b280884451ed66caf416af38716
-
SHA256
6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9a
-
SHA512
e5386d29e2eeeb2b4272a23788127098310811c5916cd7090147ec23ebf3607e07f87b61b838a41e540a72992a06bc8448f412b1a919f6e749b40ed75234621e
-
SSDEEP
1536:/7ZQpApze+eJfFpsJOfFpsJ5DLwKP2awclvmxaKP2awclvmxLlnlE:9QWpze+eJfFpsJOfFpsJ5DLhP2awclvQ
Malware Config
Signatures
-
Renames multiple (3120) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UTC.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_ja.jar.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-environment-l1-1-0.dll.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nipigon.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\javafx-mx.jar.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_ja_4.4.0.v20140623020002.jar.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-cli.xml.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Blanc-Sablon.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\net.properties.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Internet Explorer\en-US\eula.rtf.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ShapeCollector.exe.mui.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Mozilla Firefox\mozavutil.dll.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tokyo.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.zh_CN_5.5.0.165303.jar.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_ja.jar.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libheadphone_channel_mixer_plugin.dll.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2iexp.dll.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.nl_zh_4.4.0.v20140623020002.jar.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\vlc.mo.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Honolulu.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-options-api.xml.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+5.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Amman.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-ui.xml.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\imap.jar.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-uihandler.xml_hidden.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.properties.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jre7\bin\JAWTAccessBridge-64.dll.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.properties.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_ja.jar.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Microsoft Games\Mahjong\ja-JP\Mahjong.exe.mui.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Nauru.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\topnav.gif.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_zh_4.4.0.v20140623020002.jar.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jre7\bin\dt_socket.dll.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgRes.dll.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationCore.resources.dll.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Internet Explorer\en-US\jsprofilerui.dll.mui.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\jni_md.h.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\gimap.jar.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.properties.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Gibraltar.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Microsoft Games\Chess\ChessMCE.lnk.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.ServiceModel.Resources.dll.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Martinique.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-core-timezone-l1-1-0.dll.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libdshow_plugin.dll.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tipresx.dll.mui.tmp 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe"C:\Users\Admin\AppData\Local\Temp\6843ded980458e184d527737563393ef78d7e26d84ae8d6eb06753dffb287b9aN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2868
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD5d882fa25b17235b44e449afd61b5f088
SHA1d04da911a592e10a65d0e2875482afddfaa2ea18
SHA2564dc73e26f3b98fe25673de3e46fd6dd0b9489f6ef5a8b053014f3f1a684c8ce3
SHA5123cd509e1edc97bdc3959e6824e2b7fd7f95b10d98cffe7d5f29f69c11021c44627d99be49751b3f54493bf06562676245c809398ae31754ab4d6b60b35d4ebb8
-
Filesize
102KB
MD56ee575b1ce342afdc57bfa77682b3adc
SHA1a40573f058caf3d6a16d9a9c829c193b2dd30d70
SHA256b065838ebbd8afd84aab978ef0ea1d67e90b8cd9cbb16d0037462cb577295fab
SHA5124d7f951ae3607ae3b966d9ad3996afe8fe1810b48dee45ed9e54f042408c82b57d63875961d13447251928869292ba6cc93a0a8c2f72a840b5f566de77992e6a