Analysis
-
max time kernel
55s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
12-11-2024 11:59
Static task
static1
Behavioral task
behavioral1
Sample
68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe
Resource
win10v2004-20241007-en
General
-
Target
68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe
-
Size
753KB
-
MD5
058d26dda59a2ff3bdc12ec06a87722b
-
SHA1
2a4f2471ca00d1280d5a00ed308edcd7487239f5
-
SHA256
9bc3d857b4efdf6e044a9697e1c66b12e9bc7527d6785f098981f9e1803e81e2
-
SHA512
8f030f9b84e3ef3e6ec90575f83cd11bdca0a8278691fa60745c995dcd7705f8a01d0afc4931fc239a09d2859c586e1dda5968ee6f06fe74c5c0385c499b2bfa
-
SSDEEP
6144:PDiUIIk3dxdtAqZj3y2VCYNyRwWE5OphyRRrhd9py+2Va8BgqOTQAUp5Yz+v7sGX:PDkXAoDLNyMrYI2g+p5Bv7z
Malware Config
Signatures
-
Renames multiple (257) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exedescription ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SecStoreFile.ico.pif 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm.html.pif 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html.pif 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\CONTACTL.ICO.pif 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\TASKL.ICO.pif 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\clock.html.pif 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\settings.html.pif 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\INDOMAIN.ICO.pif 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\MAIL.ICO.pif 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\currency.html.pif 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html.pif 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\calendar.html.pif 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\settings.html.pif 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\slideShow.html.pif 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html.pif 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files\Windows Mail\WinMail.exe 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\cpu.html.pif 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCDRESTL.ICO.pif 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files\Windows Media Player\setup_wm.exe 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCDRESPL.ICO.pif 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\epl-v10.html.pif 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\FOLDER.ICO.pif 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsPreviewTemplate.html.pif 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files\Internet Explorer\images\bing.ico.pif 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\flyout.html.pif 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\settings.html.pif 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\RECS.ICO.pif 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\StatusAway.ico.pif 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\calendar.html.pif 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html.pif 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\StatusOnline.ico.pif 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\settings.html.pif 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\TASKDECL.ICO.pif 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe 68f03159a8067ff24a4a95235121b5763ce66d43f1d17374a16bdd10f9330417N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
544KB
MD5c0a74023b633fd962053fc9592d18b45
SHA160a77887f676650119d71cdb4e9cda7234235c8b
SHA256fa14ce0cead3ee68bfe224eb9a2a1ef85261265e31cbb9e4d509800c83338602
SHA512001f577f927ffe51c6152a68e2242245bb299a3cc2d76456b6aa6563e4321b18d728ee5c41dc90ca797c7b8aba16b00a0a2713a20bdace8b1b99d0fd9c4837bb