Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14-11-2024 10:16
Behavioral task
behavioral1
Sample
4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe
Resource
win10v2004-20241007-en
General
-
Target
4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe
-
Size
87KB
-
MD5
c7be29851b7daa7f6c10e70c28d98a8e
-
SHA1
b1b27b50ff3e144bba6b0312bdd4c9c866ff6098
-
SHA256
4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e
-
SHA512
ae28b13a18680b647850b75a6f661d94c1bdba606b6a1e8678cce0d5aa29309e587a54bbe0dd03c4722d2456cdca2ccd87939cbb7e6914c66c12abb692155714
-
SSDEEP
768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATBYMp:CTW7JJZENTBYMp
Malware Config
Signatures
-
Renames multiple (3089) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
resource yara_rule behavioral1/memory/2792-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000b000000012281-2.dat upx behavioral1/files/0x000200000001067f-6.dat upx behavioral1/memory/2792-69-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exedescription ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Maldives.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7MDT.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.xml.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\MANIFEST.MF.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-5.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.p2.ui.overridden_5.5.0.165303.jar.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_zh_CN.jar.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Nairobi.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Internet Explorer\iedvtool.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Chisinau.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\art\01_googleimage.luac.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jre7\lib\zi\America\Rankin_Inlet.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jre7\lib\deploy\messages_sv.properties.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\vlc.mo.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Glace_Bay.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-outline.xml.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-charts.xml.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jre7\lib\deploy\messages_it.properties.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\7-Zip\Lang\th.txt.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Kwajalein.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Resources.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbynet.jar.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor_1.0.300.v20131211-1531.jar.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\alt-rt.jar.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_zh_4.4.0.v20140623020002.jar.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mac.css.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Rangoon.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsFormsIntegration.resources.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nassau.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs.xml.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_scrapbook_Thumbnail.bmp.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Kuching.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Davis.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.bat.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.xml.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_zh_4.4.0.v20140623020002.jar.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_zh_CN.jar.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Mozilla Firefox\browser\features\[email protected] 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Conversion.v3.5.resources.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jre7\bin\jabswitch.exe.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\vlc.mo.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.metadataprovider.exsd.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_zh_4.4.0.v20140623020002.jar.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multitabs.jar.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-output2.xml_hidden.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Microsoft Games\Mahjong\de-DE\Mahjong.exe.mui.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Honolulu.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\include\jvmti.h.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_de.properties.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Oral.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives_1.1.100.v20140523-0116.jar.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_ja.jar.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe"C:\Users\Admin\AppData\Local\Temp\4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2792
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD5357c772a33f4817a4fe7e55a74860dd5
SHA1d1ac47f71a61f35c86b162747ed50d9e71750f11
SHA256af40a29106f557debe6aaeae8c220620aecce392e44907b0296754939edd77bb
SHA512de90bed75f9ad2cf6c5c0c103372a0dada6405dbe2a99d4516b42e49cfb7c1d1ab0157a22eaed94f6b05df531e012b452279b346bbb87f213d9b7d98e9c17656
-
Filesize
96KB
MD5bf52c9eec05c6b4fab15c33741a0dc4c
SHA1a62868964aae50ced1c0fd962aafd245373089ff
SHA256de8432d9f22d2cab283ba26356226c3abc1a5484ea251a34ab3490a59c0a349d
SHA5122dcc296b368412449958345671d98288075ead60539d10e54efe0dbbf94fd7704c17038519d616388a42257cbb56a956ac2e906e677bb8ac981604f2863ca56e