Analysis
-
max time kernel
18s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
12-11-2024 11:37
Static task
static1
Behavioral task
behavioral1
Sample
ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe
Resource
win10v2004-20241007-en
General
-
Target
ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe
-
Size
190KB
-
MD5
91bfe087434d511c950ff886f832da50
-
SHA1
820075cd1f7b39845d9044ee48e64a1f1db415de
-
SHA256
ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206f
-
SHA512
c889e1f4fa9ffda7fab6b66d3cd14e3d5f2d6b1e8f5c3f9da45141693084408b5c07c152f19ac63ec494aba36db4a08555480a3a953ce75b011088d7831a17bd
-
SSDEEP
3072:PDl9Fmmt0fSoD74DxauQDrF4Z6h/SMYy87vAQxk7y6Jxn7eHHLHZhV:PDNmmt0fSoD7ya/F66h/SMYy81xke6fE
Malware Config
Signatures
-
Renames multiple (255) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exedescription ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\OFFLINE.ICO.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\7-Zip\7zG.exe ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile.html.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm.html.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\calendar.html.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\settings.html.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBrowserUpgrade.html.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\settings.html.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\settings.html.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\currency.html.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\settings.html.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\epl-v10.html.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\EXITEMS.ICO.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsFormTemplate.html.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\PDXFile_8.ico.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCDRESTS.ICO.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\settings.html.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\view.html.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\cpu.html.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\settings.html.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\weather.html.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\Windows Mail\WinMail.exe ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\IPMS.ICO.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\VIEW.ICO.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\calendar.html.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\settings.html.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsHomePage.html.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\settings.html.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html.pif ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe ab6baf5a09b705d5e3a58d2ab5a77e36fa40546039654a6b47cc66facf4b206fN.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
544KB
MD5c0a74023b633fd962053fc9592d18b45
SHA160a77887f676650119d71cdb4e9cda7234235c8b
SHA256fa14ce0cead3ee68bfe224eb9a2a1ef85261265e31cbb9e4d509800c83338602
SHA512001f577f927ffe51c6152a68e2242245bb299a3cc2d76456b6aa6563e4321b18d728ee5c41dc90ca797c7b8aba16b00a0a2713a20bdace8b1b99d0fd9c4837bb