Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/01/2025, 15:10
Behavioral task
behavioral1
Sample
130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe
Resource
win10v2004-20241007-en
General
-
Target
130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe
-
Size
410KB
-
MD5
33fe59d1061033e877ca64d01784c21e
-
SHA1
6eb38b40fcb52e52fc189cedb91b04aa8b743ecd
-
SHA256
130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21
-
SHA512
fa5da4c911fa26ae81c4d87487b00ce3d67e4e6a2fa62ee914c982a99e95082fde9873126d7054da8349d8d0c3d1e23a51cf7d6d01df0b8200e54ea573cd3e1c
-
SSDEEP
6144:KbEyyj2yAIJbIjNDv0bNXkbvLiP+Eyyj2yAIJbIjNDv0bNXkbvLiP8:WyAUbIZGNXkbvLpyAUbIZGNXkbvLF
Malware Config
Signatures
-
Renames multiple (1927) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2068-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000c00000001226b-2.dat upx behavioral1/files/0x0002000000010617-6.dat upx behavioral1/memory/2068-68-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\pt-br.txt.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyclient.jar.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\management.dll.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.properties.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-charts.xml.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_ja.jar.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\7-Zip\descript.ion.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-output2.xml.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-loaders.xml.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\7-Zip\Lang\ps.txt.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_100_percent.pak.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Tucuman.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.properties.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.properties.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_zh_4.4.0.v20140623020002.jar.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.bfc.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-api-caching.jar.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-core.xml.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\7-Zip\Lang\kk.txt.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sl.pak.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Eucla.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-favorites.jar.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_zh_CN.jar.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.ja_5.5.0.165303.jar.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.core_3.5.0.v20120725-1805.jar.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_ja.jar.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net_1.2.200.v20140124-2013.jar.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluHandle.png.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\orb.idl.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\profilerinterface.dll.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Stockholm.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\el.pak.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe.tmp 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe"C:\Users\Admin\AppData\Local\Temp\130dd78932f6d56ad9180f7dd40f04d41bced0bd23502d84edbb2c0b4881ee21.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2068
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
410KB
MD541e834d3e6edf200986495085d5d4680
SHA1c99de27d979a563c7a08e30e683ba3dce83731ff
SHA256ea7a56b1f43942fb7fd2e2defd6b404dbc7d276618d37cbaa7a3967a99dd335e
SHA512e901e965a2ba9c688e0d9677b0e24663e989a3dcf18d1308a95e228e52b5936f10fc3a9d1ecf6153d879e83d6dc87d8d61b4a7cb57b2fb6ce947431b0e130a65
-
Filesize
419KB
MD5eff03755909631e34058a8dc2934d76b
SHA11ab7d98c39b2d87c87c4de843c7fb85e2b198895
SHA256437e54ff6214f0ce140793f3ffde3794af6ffb4822680d2d9886409384271f1d
SHA5125519f0d9825b2c61289d86f5b42316b5425050381f439bd65554c62730b761d70d0ab575f73800cc1bc088f1702e38bc3d4f81cb4d3eab42e8b2ae43c68b5576