Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12-11-2024 15:56
Behavioral task
behavioral1
Sample
8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe
Resource
win10v2004-20241007-en
General
-
Target
8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe
-
Size
77KB
-
MD5
81c20fde6ec37ac57309bb5fb82de46e
-
SHA1
ee1bf25af1dceb9d149b1e511fc972e278478bb2
-
SHA256
8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954
-
SHA512
59f04f44f5155abcc8da8951808f21c1e47cc38aea9e40a83ec2e1b29433defbd0959712f403d16ed04aad081e191e9b2525653b42b51658d339f66c16cb889b
-
SSDEEP
1536:CTW7JJ7TWsdj2hkAeCgI3i0CJS1Il+lMq:h6yj2yAeCgjJq
Malware Config
Signatures
-
Renames multiple (2620) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
resource yara_rule behavioral1/memory/1344-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000b0000000120f6-2.dat upx behavioral1/files/0x000c000000010546-6.dat upx behavioral1/memory/1344-51-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exedescription ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Microsoft Games\Mahjong\Mahjong.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler.xml.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunjce_provider.jar.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk_1.0.300.v20140407-1803.jar.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\7-Zip\Lang\ca.txt.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-CN.pak.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-remote.jar.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Microsoft Games\Chess\es-ES\Chess.exe.mui.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Costa_Rica.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\MANIFEST.MF.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-attach.xml.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Pohnpei.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\US_export_policy.jar.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Blanc-Sablon.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+2.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.win32.x86_64_1.0.100.v20130327-1442.jar.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.metadataprovider.exsd.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-io.xml.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\7-Zip\Uninstall.exe.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tripoli.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia_Banderas.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.jasper.glassfish_2.2.2.v201205150955.jar.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\7-Zip\Lang\nn.txt.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kosrae.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcfr.dll.mui.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_zh_4.4.0.v20140623020002.jar.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_ja.jar.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_zh_CN.jar.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jre7\lib\currency.data.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Microsoft Games\Chess\ChessMCE.lnk.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+6.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Common Files\System\msadc\msadcfr.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\splash.gif.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-modules_zh_CN.jar.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_zh_CN.jar.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multiview.jar.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-execution.xml_hidden.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jre7\Welcome.html.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Luis.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jre7\bin\installer.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\7-Zip\Lang\cs.txt.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Seoul.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\GMT.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.xml.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jre7\lib\zi\America\Sao_Paulo.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-3.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\w2k_lsa_auth.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-9.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.contenttype_3.4.200.v20140207-1251.jar.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_ja_4.4.0.v20140623020002.jar.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\South_Georgia.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Athens.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe"C:\Users\Admin\AppData\Local\Temp\8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1344
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
77KB
MD5b20fdc49d8316f7533f706b1f7cb9718
SHA1e8b48babbcb7c1162f475ad9c602da9e3cf17209
SHA256ca6079387dad9ed9b06274ff79439d68284a396ef96e5cef7c90d2b62825602a
SHA51206d3fd2bf2b382216d5cc56496edc326c00032fbcb40e69c01201678062d24a71370a544736da77baeba98d45ab0040d2a7243788bf99c8ae287158f2bc540d3
-
Filesize
86KB
MD56ed6270ce1edb81ab4b3b2a407473a0d
SHA188347ca5010397f372d41559e887d9686991f7ac
SHA2565cbedf354a43e3930d97f8ad723e421528abee5509bf8e612d9e29ec05cfd50a
SHA512ecad405e975abe77b4f961ee11864ffad08466739b55c6c70f38a7eae844bf8aad5814a3ad4baa3c76c64615550fc8dddfb341c1b104e6f73d4f6a692cdbbc4b