Analysis
- max time kernel
120s - max time network
22s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
14/11/2024, 00:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
120 seconds
General
- Target 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe
- Size 77KB
- Sample241114-a2pt2svqgp
- SHA256 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93
- MD5 53cbbb5ab26120fb6937edc86d5debd0
- SHA1 27e4bf4d625a042ddd393083f5d635c6158766b3
- SHA512 bda39dd78b9700462f4104e5e728ef94400c3f8dd7195ba052623fce5294af8f518f028ef0cf97b8445ca792fe383cc239ce57cb972c861cd0855eb1b000bf2a
- SSDEEP 1536:W7ZhA7dAynMdyGdy4AnA4QLIyIBmJYAJYl:6e76ynpADIyIB
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (2734) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Moncton.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Funafuti.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Rarotonga.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.xml.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4.ssl_1.0.0.v20140827-1444.jar.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Internet Explorer\en-US\eula.rtf.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Salta.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Chisinau.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Luxembourg.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mauritius.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Amman.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\AST4ADT.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File B.txt.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_zh_4.4.0.v20140623020002.jar.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mip.exe.mui.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_ja.jar.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\7-Zip\Lang\eo.txt.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nipigon.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvm.xml.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240811.profile.gz.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.dll.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Metlakatla.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-lib-uihandler.xml_hidden.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Microsoft Games\Minesweeper\es-ES\Minesweeper.exe.mui.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask_PAL.wmv.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jre7\lib\deploy\messages_es.properties.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Noronha.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host.xml.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jre7\bin\JAWTAccessBridge-64.dll.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_ja.jar.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\rtscom.dll.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novosibirsk.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Karachi.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.app_1.3.200.v20130910-1609.jar.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_ja_4.4.0.v20140623020002.jar.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_zh_CN.jar.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\DVD Maker\Pipeline.dll.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.win32.x86_64_1.0.100.v20130327-1442.jar.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Casablanca.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Nassau.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-12.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Vienna.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-14.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Microsoft Games\Solitaire\en-US\Solitaire.exe.mui.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\instrument.dll.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views_3.7.0.v20140408-0703.jar.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_zh_CN.jar.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\core_visualvm.jar.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe"C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2104
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp
- Size 77KB
- SHA256 f7372abef11e2ba1d70ac356b939aed32927dae163152cfb404040ed240dfd9e
- MD5 c2749de31d2d1ca4a1727a9189750e22
- SHA1 0ab19194290dd36bbc2c283b2bf07fbdae0e3288
- SHA512 3a603391d88f075ffdfdf276c981646fc881fddb26ae9c448bf2f06ddf5c4a331071f93ca0c667bfe7a6f2f53ca2e37ce460043836b1a3e326bce535c18be124
- SSDEEP 1536:W7ZhA7dAynMdyGdy4AnA4QLIyIBmJYAJYP:6e76ynpADIyIT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
- Size 86KB
- SHA256 3efa9da09e45221101469e8dc5fbdcdcbe47058fb24855504014b3abb1dce830
- MD5 e5b6f63f5863f5bf94ef6f6187923b57
- SHA1 c7afae3c17470dc0887ebdd62f96f1db9532e093
- SHA512 c3c1ef2579e2307598dbfd22ecd8a6550ed14f3f664326d66bdbdcca7653a6b49ac8a574279f6843cd30ad505b85e2c144bf0d289667321baa640c02ea0e758f
- SSDEEP 1536:W7ZhA7dAynMdyGdy4AnA4QLIyIBmJYAJYe:6e76ynpADIyIa
- MD5 SHA1 SHA512 SSDEEP