Analysis
-
max time kernel
28s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
12-11-2024 15:55
Static task
static1
Behavioral task
behavioral1
Sample
f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe
Resource
win10v2004-20241007-en
General
-
Target
f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe
-
Size
2.5MB
-
MD5
e41c0a5c94c527fc42b45eadf90f0a10
-
SHA1
bcd3ad1a81a3d930c0bff1f24b80a5da03a65df3
-
SHA256
f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321c
-
SHA512
b9f835cbabb73782ce5a5e288e9828621cf32082137cf56edcd5d6e626eb3e9b06939595e6c49182fe51c22b8446e25dcb191d17d09c0324c3030e8e286f504d
-
SSDEEP
49152:yWN3avHK72BX21c1XTxwDqoEZ/SGTip8uRXXYR0H:vcLBXjlcaZmxRZ
Malware Config
Signatures
-
Renames multiple (256) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exedescription ioc Process File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\calendar.html.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\calendar.html.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\weather.html.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\CHEVRON.ICO.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCDCNCLS.ICO.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\TASKDECS.ICO.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsMacroTemplate.html.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\OnLineBusy.ico.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\clock.html.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\currency.html.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\settings.html.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\PDXFile_8.ico.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\settings.html.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\epl-v10.html.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\clock.html.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsFormTemplate.html.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\TASKREQS.ICO.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Internet Explorer\images\bing.ico.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\SpaceSelector.ico.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\OUTGOING.ICO.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\slideShow.html.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\settings.html.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\RECS.ICO.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\OutDomain.ico.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\flyout.html.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\settings.html.pif f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe f49c37ec77cd3263794b346e4776cbbe7636b82fcaac5e0eb3e1a918feea321cN.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
544KB
MD5c0a74023b633fd962053fc9592d18b45
SHA160a77887f676650119d71cdb4e9cda7234235c8b
SHA256fa14ce0cead3ee68bfe224eb9a2a1ef85261265e31cbb9e4d509800c83338602
SHA512001f577f927ffe51c6152a68e2242245bb299a3cc2d76456b6aa6563e4321b18d728ee5c41dc90ca797c7b8aba16b00a0a2713a20bdace8b1b99d0fd9c4837bb