Analysis
- max time kernel
150s - max time network
123s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
14/11/2024, 04:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe
- Size 78KB
- Sample241114-e4ybestnfz
- SHA256 f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3
- MD5 885001f868bdefcd5cd230efa4da56d8
- SHA1 f40c84ba3f6ed6d1d7fad444a8b6046b82c8de8d
- SHA512 e7b40dbe68c4ed1b4b204a5919d0970a4d9efb35636a2e3fd41fb653a74b973cfe7b8097a6246ae0018c54cb5e5593295e3981787d12972d97a75ad44cb9cf14
- SSDEEP 768:W7BlphA7dASbS7EXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKeB:W7ZhA7dAynMdyGdy4AnA4QLIyIBs
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (2887) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tehran.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_zh_4.4.0.v20140623020002.jar.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_ja_4.4.0.v20140623020002.jar.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_zh_4.4.0.v20140623020002.jar.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-remote.xml.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jre7\lib\ext\sunjce_provider.jar.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vevay.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Taipei.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jre7\bin\j2pcsc.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_ja.jar.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\Buenos_Aires.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-10.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\7-Zip\Lang\ku.txt.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Apia.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_zh_4.4.0.v20140623020002.jar.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.shell_0.10.0.v201212101605.jar.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.properties.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\tr.pak.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mauritius.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\imap.jar.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-api.xml.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\7-Zip\Lang\pt-br.txt.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.zh_CN_5.5.0.165303.jar.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\THIRDPARTYLICENSEREADME.txt.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_ja.jar.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationFramework.resources.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyrun.jar.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\eula.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Vancouver.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_zh_CN.jar.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jre7\lib\zi\PST8PDT.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Engine.resources.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\vlc.mo.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zurich.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-14.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\7-Zip\Lang\hi.txt.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_HK.properties.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\flight_recorder.png.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsFormsIntegration.resources.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Amsterdam.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7MDT.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host.jar.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Nauru.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClientsideProviders.resources.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Brisbane.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.pb_2.3.5.v201404071733.jar.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core_zh_CN.jar.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_ja.jar.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_highlights_Thumbnail.bmp.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe"C:\Users\Admin\AppData\Local\Temp\f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2892
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp
- Size 78KB
- SHA256 4e8e036690ccb28c731127dd48b81e19f0678beefc3f58111a894d673a96046e
- MD5 2d813fd73f5eab382c5e72b8663737e7
- SHA1 ed090ca37768aeee7420b6673b8f4788f0336d1c
- SHA512 5c7f1249b954236a99f68f52c609f17e2d40093767d47d44f4a0daee0ddfd12b006b3776e27c2e65624ba3c3cdba601df53f7d08994bd9a115b53d32fadd73d6
- SSDEEP 768:W7BlphA7dASbS7EXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKeg:W7ZhA7dAynMdyGdy4AnA4QLIyIBJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
- Size 87KB
- SHA256 1ecd5fd600fa0130e6da800dc9a9618815f30b5b9dd168061937ea35d394d3cb
- MD5 b7dbc4a2358d10a3deeb5a714718cfd1
- SHA1 ddfab9ee25d1d9581bda74d851bbe2823c7146e0
- SHA512 68450e5ef970a47d6793a6e8868868b55da99801b109e39c72b4cd1de974b457bf96df3c4623500230a6231289113c50c7a9a4873182c7b6f33a57646a53af48
- SSDEEP 768:W7BlphA7dASbS7EXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKeW:W7ZhA7dAynMdyGdy4AnA4QLIyIBv
- MD5 SHA1 SHA512 SSDEEP