Analysis
-
max time kernel
12s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
12-11-2024 12:27
Static task
static1
Behavioral task
behavioral1
Sample
70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe
Resource
win10v2004-20241007-en
General
-
Target
70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe
-
Size
238KB
-
MD5
0b69cf6e60fb68d4eec9978f5472b541
-
SHA1
d254dd425b4807ed2daec3782033f1ba0fd15370
-
SHA256
f0f7f1041caa54f45792c18f9c7e80031e5e31abb3d046f5ab7222e3263b16d8
-
SHA512
8b21ad7bf9fb10009a6b895eb2004bcb411b93c88c3922e6b57e2118b8596e22cc5c768f2f4d998dcb3a02ed6307887e07e84f8b4acb5dfee74f18418907ca37
-
SSDEEP
3072:PDVef/hIVofyhSOUuC4v/oVx8Gugbdm9AYvZz5THnbez3PoL9Uw:PDc/hIifyPGugbdzYow9h
Malware Config
Signatures
-
Renames multiple (255) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exedescription ioc Process File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\cpu.html.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewTemplate.html.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsPreviewTemplate.html.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\StatusAway.ico.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\flyout.html.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\slideShow.html.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\flyout.html.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\REMOTES.ICO.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCDRESNS.ICO.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files\Windows Media Player\wmpenc.exe 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\FOLDER.ICO.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\RSSFeeds.html.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\calendar.html.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\weather.html.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\XDPFile_8.ico.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCDRESNL.ICO.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FORM.ICO.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\cpu.html.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\flyout.html.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\MMSL.ICO.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files\Internet Explorer\images\bing.ico.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCDRESTL.ICO.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\settings.html.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\slideShow.html.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files\VideoLAN\VLC\VideoLAN Website.url.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\POSTS.ICO.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsHomePage.html.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsBrowserUpgrade.html.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\picturePuzzle.html.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\settings.html.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCDREQL.ICO.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SMSS.ICO.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\license.html.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\IPML.ICO.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\VIEW.ICO.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPrintTemplate.html.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\picturePuzzle.html.pif 70384e668b5fafee07108f165d1e98eda4d3a4822dfc8be46f6e255e6a8a798fN.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
544KB
MD5c0a74023b633fd962053fc9592d18b45
SHA160a77887f676650119d71cdb4e9cda7234235c8b
SHA256fa14ce0cead3ee68bfe224eb9a2a1ef85261265e31cbb9e4d509800c83338602
SHA512001f577f927ffe51c6152a68e2242245bb299a3cc2d76456b6aa6563e4321b18d728ee5c41dc90ca797c7b8aba16b00a0a2713a20bdace8b1b99d0fd9c4837bb