ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
06/04/2024, 05:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
Size

58KB
MD5

4fd4b4c230b053f6ee146e1bff0b8faf
SHA1

d3a1f9a4ba40ff2953a3633380088dca27e1dd5c
SHA256

ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148
SHA512

efe7b3c35a8e92b1ad8492df3bda6a376c7584a7be0ccf08c50e6dd099d95701652898e7488f70d4455e9bb0a2e16d38492e056809c75007c2f81f37d792bd59
SSDEEP

768:W7BlpDpARFbhYQkQjjI6OvSox/6Sox/hotyuv:W7ZDpApYbWjIlE77uv

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3638) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dubai.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.security_8.1.14.v20131031.jar.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Java\jre7\bin\sunmscapi.dll.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\currency.css.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuy2_i420_plugin.dll.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color32.bmp.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_dot.png.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.properties.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation_1.2.100.v20131119-0908.jar.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_ja.jar.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-nodes.jar.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_ja.jar.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Management.Instrumentation.dll.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_winxp.css.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_zh_CN.jar.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\vlc.mo.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_ja.jar.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\modules\host.luac.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\weather.css.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zurich.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\localizedStrings.js.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Internet Explorer\en-US\F12Resources.dll.mui.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Java\jre7\bin\java_crw_demo.dll.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\gadget.xml.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\highDpiImageSwap.js.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_postage_Thumbnail.bmp.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages.properties.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_windy.png.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\awt.dll.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\US_export_policy.jar.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_ja_4.4.0.v20140623020002.jar.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libddummy_plugin.dll.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_chromecast_plugin.dll.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\3.png.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\tesselate.x3d.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Common Files\System\msadc\msadcs.dll.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\tzmappings.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UTC.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Manila.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_settings.png.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\5.png.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\chapters-static.png.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.xmi_2.10.1.v20140901-1043.jar.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\VideoLAN\VLC\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\logo.png.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\34.png.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_rainy.png.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.hyp.tmp	ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe

C:\Users\Admin\AppData\Local\Temp\ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
"C:\Users\Admin\AppData\Local\Temp\ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe"
1⤵
- Drops file in Program Files directory
PID:2192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini.tmp

Filesize
59KB

MD5
34b1d07600210ac2ef949aad9993e4e4

SHA1
39f68f1cab70378f65bb54d878793036fdaf2cd6

SHA256
8868654816f05e796636bb79e1a17f4a4b9fa12e7bf89c9b1700ba7ee65d3eaa

SHA512
57967ff4bca8560879061bc6de836dc2dd7ec7002c1e1326dc4de49d6526c6fbad694ab5616f45198d901a3f496f8e1c0daf37b309efa0d21ea0aed4433a59b9

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
68KB

MD5
f23f26e46d80d58495a0660cabd1c6e5

SHA1
27a23e9a4903688adec3489e9221a3dc2ca962a5

SHA256
2ebd2d468ba26c395981a72421d0f95f428d1d0a1d46bda2f8928a251c8549da

SHA512
2e2606d1a7f48f893db4eaaccf97e7e502d6a1909aaa13f093bdb220a48d72fb086c2bb15c90ce5a889b41e4caa6b42af5b400fd3b2179598740a323a3cc95a8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads