Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
06/11/2024, 01:09
Behavioral task
behavioral1
Sample
07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe
Resource
win10v2004-20241007-en
General
-
Target
07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe
-
Size
130KB
-
MD5
ece0854ff908fe5521f959a11ad5a940
-
SHA1
6e5772edbcf2e3b46a3216e20ebada742f3d2aee
-
SHA256
07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1
-
SHA512
5b7aa294cf872f4da10ce5cce681ff7ead404e05ddf46686791c45c37244aff868342bf06d61a81df05fe7170161789918b9847133edeadd12c81bbe8740430e
-
SSDEEP
3072:hoRUhehbIyIMQ4Aa1ZthsMxFUy4ipiIUpB6Bo:CRUhehb15QYZthsMxFQJIUj
Malware Config
Signatures
-
Renames multiple (3456) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2520-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x00070000000120fe-2.dat upx behavioral1/files/0x0005000000010479-6.dat upx behavioral1/memory/2520-75-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_olv.css.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-uihandler.xml.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Kolkata.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\dt.jar.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-lookup.xml.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Aqtau.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Xml.Linq.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\vlc.mo.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\7-Zip\readme.txt.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\vlc.mo.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libwgl_plugin.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Windows Defender\MpCommu.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\attach.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore_2.10.1.v20140901-1043.jar.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Luna.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tabskb.dll.mui.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipRes.dll.mui.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_zh_CN.jar.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jre7\bin\server\Xusage.txt.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClientsideProviders.resources.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\GoldRing.png.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Internet Explorer\msdbg2.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Hobart.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_zh_4.4.0.v20140623020002.jar.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\vlc.mo.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_ja_4.4.0.v20140623020002.jar.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBlue.png.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs_5.5.0.165303.jar.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_zh_CN.jar.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jre7\bin\sunmscapi.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Xml.Linq.Resources.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Windows Defender\en-US\MpEvMsg.dll.mui.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Windows Media Player\es-ES\wmpnssui.dll.mui.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\d3dcompiler_47.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kwajalein.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\org-openide-filesystems.jar.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\librawvideo_plugin.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_ja_4.4.0.v20140623020002.jar.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application_5.5.0.165303.jar.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf_3.4.0.v20140827-1444.jar.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Mozilla Firefox\AccessibleHandler.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.properties.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.properties.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\MANIFEST.MF.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Havana.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationBuildTasks.resources.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\vlc.mo.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.ui_1.1.200.v20130626-2037.jar.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security_1.2.0.v20130424-1801.jar.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jre7\lib\deploy\messages_de.properties.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_ja_4.4.0.v20140623020002.jar.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Microsoft Office\Office14\ONLNTCOMLIB.DLL.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_ja.jar.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multitabs.xml.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe"C:\Users\Admin\AppData\Local\Temp\07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2520
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
130KB
MD597d7d23e1be6993a3a05d379cb151b8a
SHA10a30347b51640e3fa060f95e3f89983f3861c378
SHA256afa49415f51e847bd1d07d5deca638f14f8eb96f81136bd703b7457b48da7b87
SHA512099e4c482a701d49e3af89865873a96e33ed291388a4cb6c4920dbf42aec6ca71e34c6472ba45f15b0583a7d3f52087d8445f3e01f202f4eb1ef0fd39ad0cd27
-
Filesize
139KB
MD548558e12a4e8faedf14dee0739893fc2
SHA1e65f51e693ab8c9eebbe1962356d98ddba68c202
SHA2569f4c9ecd0fa742abd2aa9dcf2b3b8b4662926c306397994ca4216cadcfa21061
SHA5124c56545b96647b843d24d5453a7e53bc0ffdf0e371e913d553b32be040e8a09fbd3080700b90e4b44acbd8ee5d8e30dfd658ebf32dec829a9028a885b9ec6351