Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14-11-2024 21:32
Behavioral task
behavioral1
Sample
43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe
Resource
win10v2004-20241007-en
General
-
Target
43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe
-
Size
73KB
-
MD5
1b7a2118de66e8e86ba6fbb393590e33
-
SHA1
844c9ba13dea247239fa464b231b54030e693c9c
-
SHA256
43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5
-
SHA512
de8b1faf39b93197b7b4683085fbeb0564f5d54854cb2d986c7d45cab587481df9ae1512916201895b7bfa2fc8e2a3d04195642eaf61f4b147b98eb2d1fc4ba5
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/ti8zD1Gn24:V7Zf/FAxTWoJJ7TTQoQ87NMp
Malware Config
Signatures
-
Renames multiple (3490) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
resource yara_rule behavioral1/memory/840-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000a00000001225c-2.dat upx behavioral1/files/0x0002000000010541-6.dat upx behavioral1/memory/840-70-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exedescription ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macTSFrame.png.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_windy.png.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-new_partly-cloudy.png.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Prague.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single_orange.png.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\rings-dock.png.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\service.js.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Microsoft Games\Purble Place\it-IT\PurblePlace.exe.mui.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libwingdi_plugin.dll.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_zh_CN.jar.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Novokuznetsk.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.xml_1.3.4.v201005080400.jar.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_snow.png.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Internet Explorer\en-US\F12Resources.dll.mui.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\cacerts.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Java\jre7\bin\t2k.dll.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libes_plugin.dll.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_rest.png.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Internet Explorer\en-US\networkinspection.dll.mui.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-iio.dll.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Java\jre7\bin\fxplugins.dll.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\settings.css.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Java\jre7\bin\jsdt.dll.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Mozilla Firefox\browser\features\[email protected] 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Microsoft Office\Office14\1033\MAPISHELLR.DLL.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_zh_4.4.0.v20140623020002.jar.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\picturePuzzle.js.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\18.png.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management-agent.jar.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.analysis_3.5.0.v20120725-1805.jar.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\calendar.js.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-docked.png.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\7-Zip\7z.exe.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jayapura.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\vlc.mo.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Java\jre7\lib\zi\America\Mexico_City.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Mozilla Firefox\lgpllibs.dll.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\7-Zip\Lang\ca.txt.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpnr.dll.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Google\Chrome\Application\master_preferences.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Microsoft Games\Purble Place\PurblePlace2.dll.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libttml_plugin.dll.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Windows Defender\fr-FR\MpEvMsg.dll.mui.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\gadget.xml.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Anchorage.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Detroit.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ulaanbaatar.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+10.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.dll.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui.tmp 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe"C:\Users\Admin\AppData\Local\Temp\43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:840
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD51a8b3438cf37078c5892952bd273eb06
SHA11ecc7cf967579dcc77db0a4bb314af54350d7584
SHA2569fbff3b1e95978d0ea974522033eb8e7e8213d1a65cf35e00b3bf5a3f8f02403
SHA51267ec3e719d26133f66505035180e5e00276af42488ae04bb1f432e3db79b7bae96a76853bceba0ad1e62c2ececdb500906cc1eff73bc55a69fd987dceb3219ce
-
Filesize
82KB
MD5b8442cdc3f39656cb7017d19ce811272
SHA149ed2b715c5e329c14b09a6f82fc8f579bd2c948
SHA25625c76ad9f81a824245a2440dcd87608522489551486bd08d015bdfb2e108f544
SHA5123f5d536ce56b2a592f46682ca120beda5c8d4ecdb4a262026e1de17afecfd34aff873ba5d7b975ea9cc617df2976a05d2dfdbf9f04c64eac246b8ffeec3f707a