Analysis
- max time kernel
150s - max time network
123s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
12/11/2024, 16:15
Behavioral task
behavioral1
Sample
560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe
- Size 79KB
- Sample241112-tqa2aswfnd
- SHA256 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5
- MD5 58cc0359aa9555d6b6e838e8077d46e0
- SHA1 feb43111b8471bdf395c473bbaf33f16f97d043e
- SHA512 4935671bd19234da124df1af0ca162ad28f31505bd595efc4948c7c6d4565ffba38598a08dac0cec7418b44c59becc533b910f6a2a172948faae4ce0a80cd513
- SSDEEP 768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rx:V7Zf/FAxTWbiVRRNRR3EBbL
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (3436) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2448-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000d000000012272-2.dat upx behavioral1/files/0x0002000000010617-6.dat upx behavioral1/memory/2448-68-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.ssl_1.0.0.v20140827-1444.jar.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_zh_4.4.0.v20140623020002.jar.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_zh_CN.jar.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\chkrzm.exe.mui.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\calendar.js.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_ja.jar.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jre7\lib\zi\America\Belem.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libpanoramix_plugin.dll.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chatham.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\libwin_msg_plugin.dll.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libogg_plugin.dll.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_disabled.png.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Windows Defender\MsMpRes.dll.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\currency.css.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-background.png.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\highlight.png.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt_0.12.1.v20140903-1023.jar.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-api.jar.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsBase.resources.dll.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\vlc.mo.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\7-Zip\Lang\gu.txt.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jre7\lib\content-types.properties.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Currie.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\vlc.mo.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\0.png.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Rarotonga.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui_5.5.0.165303.jar.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1665.dll.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Royale.dll.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Windows Media Player\fr-FR\mpvis.dll.mui.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santarem.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.zh_CN_5.5.0.165303.jar.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-options-keymap.xml_hidden.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jre7\lib\cmm\LINEAR_RGB.pf.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\7-Zip\Lang\ca.txt.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_TW.properties.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Srednekolymsk.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libaribcam_plugin.dll.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2iexp.dll.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_zh_4.4.0.v20140623020002.jar.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_zh_CN.jar.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Windows Media Player\fr-FR\WMPSideShowGadget.exe.mui.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\currency.js.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\optimization_guide_internal.dll.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_ja.jar.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_zh_CN.jar.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Subpicture1.png.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Reykjavik.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_zh_4.4.0.v20140623020002.jar.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-options.xml_hidden.tmp 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe"C:\Users\Admin\AppData\Local\Temp\560d624a4d799f4434ed0603304a3a5cff790d74a337f3a688258493812582c5.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2448
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp
- Size 79KB
- SHA256 442cffb5224008265e239fe9d7e2db1ec954aad821566272a4766091e46f2ead
- MD5 cac58a926cceba8c8b958ced1ce3c833
- SHA1 3e6b3c2de0c0abad67c65b43b380cbd93ace2657
- SHA512 5ae696cd473a96e6854d11af2056ccc052941d6abff50b1e533b2968aed385248a566ba317d201901482a50de811a8f6779533e1e8a8d0927cf299c237345467
- SSDEEP 768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2r0:V7Zf/FAxTWbiVRRNRR3EBbG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
- Size 88KB
- SHA256 b78569954c6b891e9f6d770e37e94e2c4a748c0e97225073004cdacae08621b2
- MD5 b9b7fc6f5896697d551c053c19fc1c09
- SHA1 c349e9954810caede56e59cdbb052f9b4a2f42b1
- SHA512 8deabd114d52021b545e448ab3ed679ea112b64a985237fdc8edc5f197d3de6901ef4e5b047afb8a3d7bbdc4d4dc364e07e5d1059acfde08d57f0d3f46ff3fb3
- SSDEEP 768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2r1:V7Zf/FAxTWbiVRRNRR3EBbL
- MD5 SHA1 SHA512 SSDEEP