Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12-11-2024 16:00
Behavioral task
behavioral1
Sample
8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe
Resource
win10v2004-20241007-en
General
-
Target
8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe
-
Size
77KB
-
MD5
81c20fde6ec37ac57309bb5fb82de46e
-
SHA1
ee1bf25af1dceb9d149b1e511fc972e278478bb2
-
SHA256
8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954
-
SHA512
59f04f44f5155abcc8da8951808f21c1e47cc38aea9e40a83ec2e1b29433defbd0959712f403d16ed04aad081e191e9b2525653b42b51658d339f66c16cb889b
-
SSDEEP
1536:CTW7JJ7TWsdj2hkAeCgI3i0CJS1Il+lMq:h6yj2yAeCgjJq
Malware Config
Signatures
-
Renames multiple (3398) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
resource yara_rule behavioral1/memory/2520-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000d000000012272-2.dat upx behavioral1/files/0x0002000000010617-6.dat upx behavioral1/memory/2520-51-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exedescription ioc Process File created C:\Program Files\Java\jre7\lib\zi\EST.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sampler.xml.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_zh_CN.jar.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-modules.xml.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jre7\bin\plugin2\msvcr100.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmad_plugin.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding_1.6.200.v20140528-1422.jar.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jre7\lib\zi\Atlantic\Faroe.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Microsoft Office\Office14\Custom.propdesc.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Common Files\System\ado\adojavas.inc.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_ja_4.4.0.v20140623020002.jar.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_zh_CN.jar.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bn.pak.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\vlc.mo.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\vlc.mo.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-conio-l1-1-0.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libwav_plugin.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbynet.jar.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Majuro.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_zh_4.4.0.v20140623020002.jar.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\Marengo.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Casey.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.json.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_chromecast_plugin.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans_1.2.200.v20140214-0004.jar.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable_1.4.1.v20140210-1835.jar.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jre7\bin\unpack200.exe.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Manaus.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jre7\lib\content-types.properties.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Design.resources.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs.xml.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_ButtonGraphic.png.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground_PAL.wmv.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.descriptorProvider.exsd.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.http_8.1.14.v20131031.jar.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IdentityModel.Resources.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.Design.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libflacsys_plugin.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\rtscom.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qyzylorda.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-api.xml.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jre7\lib\zi\America\Curacao.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Mozilla Firefox\xul.dll.sig.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_chromecast_plugin.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcfr.dll.mui.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\th.pak.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cancun.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_flac_plugin.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libpodcast_plugin.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1665.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse_1.1.200.v20140414-0825.jar.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe"C:\Users\Admin\AppData\Local\Temp\8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2520
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
77KB
MD5986b23cf81b682dc53aafe5b4a4b3a45
SHA1742a4acafa16868c377d2cb6b282a7149149fb01
SHA2566123935a00fab5a9926da8116dbb563ec8766403d822291b9445479ca5f7e782
SHA512f5e0d23dd21247c671805e11f02fc720f571f731e8c0ef16b2285d23f1b9bf311c65bda0b7745123c36fc1f287faaae9e00faaf89acd4d872fdfdf244beacedb
-
Filesize
86KB
MD536c65255b440676e9233207c7d1b059e
SHA1ff8d630175d7bb2415ac9cf7ef6bbde5c315a813
SHA25668d0e1ec777fb7e576da8dd2d77f9e1cd754a7bfd05f08b356f8cdb07e733d63
SHA512f54acd825bc0cf286e922b672386caa1b2390e1fef5ff21b8f524a482e19694da1e54cff0f0a1a698117d03985e3f7c43219c00a3291bc1f953798a50c38aada