fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06/04/2024, 05:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
Size

63KB
MD5

3738cf87611e54ab2ca6a04e707fa93d
SHA1

5784fe68e5cd5b362b5e19bf30c870aaadf4cc67
SHA256

fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65
SHA512

71440e0a680398399caf21bc3a81a14fcfe65c6cded1bf37a22c9ccd665ee92b4fc45b9389dabfa6b36a4d5ee3d88df9878ed40c005b5443eab09404d88c3c74
SSDEEP

1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn67jT:6e7WpP9oVLQthbYY9oVLQthbUG

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3573) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Saipan.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_down.png.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\weather.js.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Jerusalem.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Windows Sidebar\es-ES\Sidebar.exe.mui.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyclient.jar.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_zh_4.4.0.v20140623020002.jar.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Java\jre7\lib\charsets.jar.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Vienna.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\settings.css.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.dll.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\javaws.jar.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_ja.jar.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.services_1.2.1.v20140808-1251.jar.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_ja.jar.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Merida.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vincennes.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\asl-v20.txt.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands_3.6.100.v20140528-1422.jar.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfxrt.jar.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util.gui_1.7.0.v200903091627.jar.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiling.xml.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\PST8PDT.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\BHOINTL.DLL.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdvdread_plugin.dll.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\huemainsubpicture2.png.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.jasper.glassfish_2.2.2.v201205150955.jar.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.xml.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\currency.js.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_down.png.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked-loading.png.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Mozilla Firefox\mozwer.dll.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\settings.css.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\shuffle_up.png.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticnotification.exsd.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-heapwalker.xml.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Mozilla Firefox\update-settings.ini.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\calendar.html.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\Vdk10.rst.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\content-types.properties.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Enderbury.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jsse.jar.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Knox.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Windows Journal\it-IT\Journal.exe.mui.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Vladivostok.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_disabled.png.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.security.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\drag.png.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Windows Sidebar\settings.ini.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\ant-javafx.jar.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-core.xml.tmp	fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe

C:\Users\Admin\AppData\Local\Temp\fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe
"C:\Users\Admin\AppData\Local\Temp\fd02b054a99e838255035d34dcc6edff62a66c86f298a9c19a6189a67362bb65.exe"
1⤵
- Drops file in Program Files directory
PID:2512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini.tmp

Filesize
64KB

MD5
13e18af26c57eb06927afed817de99d9

SHA1
8dfab3413d99f48089a6eef5cdfec08d12b0a4e5

SHA256
f0467f0fbecf1f92d3b5c9982e4a4b5227b6c44b4d21d1589f2becf0979fb530

SHA512
041a13ef1332e2a60793cab8ab70bea186fa33ff893bac3dd0e72419227c41560972fd2caafbd01590822fcecd3434a23a3be58256b920d872c2bfae2e197c98

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
72KB

MD5
4b0744d0c255b475d4764f766bc2feab

SHA1
d0dd84bc3bd3db8e753979b1fbe124ee61f9e715

SHA256
96e9991d9320c6e65f43d789e924523ad48e8f7adea66a30c0a218d08201d381

SHA512
56ccbcf1768140eee435dcc9c686c06fd494c235791d942603040d914774b9fe2570665878ac2ba890cfbb5d9dcaee2a4a78dff821b4b735b9ca9005fbe7a55b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads