Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25-04-2024 01:53
Static task
static1
Behavioral task
behavioral1
Sample
add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe
Resource
win10v2004-20240412-en
General
-
Target
add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe
-
Size
94KB
-
MD5
edeb313b58c9cd4a8fa161e62bc28ade
-
SHA1
8ff9fbb0aa467ad64594a85bf1221a3ec162a721
-
SHA256
add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39
-
SHA512
5eee5b6b149bf8319b72e2a34647a385a528429a54a29ce822886f006b7b5b6858da3695352040da43e8b954c802f8d1a7d20fdbd17138daf7148be06431f7e0
-
SSDEEP
1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKP761wewz8eg:6rWpcOPxPke+e3fFpsJOfFpsJbgEJRxg
Malware Config
Signatures
-
Renames multiple (3515) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exedescription ioc process File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pohnpei.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_ja.jar.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-search.jar.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\UTC.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.lnk.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedQuanPin.txt.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_s.png.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\settings.css.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\README.TXT.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-previous-static.png.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mazatlan.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tallinn.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_zh_4.4.0.v20140623020002.jar.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jre7\lib\zi\Indian\Cocos.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Microsoft Games\More Games\it-IT\MoreGames.dll.mui.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.Design.dll.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.ja_5.5.0.165303.jar.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Volgograd.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Windows Sidebar\es-ES\Sidebar.exe.mui.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-12.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libddummy_plugin.dll.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\calendar.js.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\VideoLAN\VLC\plugins\spu\librss_plugin.dll.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_windy.png.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-execution.xml_hidden.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jre7\lib\jfr.jar.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Mawson.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jre7\README.txt.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Windows NT\TableTextService\TableTextServiceAmharic.txt.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_ButtonGraphic.png.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Niue.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+5.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\art\02_frenchtv.luac.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Windows Journal\it-IT\NBMapTIP.dll.mui.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Windows Media Player\fr-FR\WMPDMC.exe.mui.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile_bezel.png.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor_1.0.300.v20131211-1531.jar.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_ja.jar.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-compat.xml_hidden.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jre7\bin\rmid.exe.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libaom_plugin.dll.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_ring_docked.png.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\localizedStrings.js.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_CN.properties.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_ja_4.4.0.v20140623020002.jar.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_ja_4.4.0.v20140623020002.jar.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_olv.css.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-execution_zh_CN.jar.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs.xml.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jre7\lib\zi\America\Pangnirtung.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Java\jre7\lib\zi\Indian\Reunion.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4video_plugin.dll.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_foggy.png.tmp add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini.tmpFilesize
95KB
MD56bb556a2e4b37b99b95a69c59027a2b7
SHA1ac10caf6c12ecd2283bac31288d72f6081601826
SHA256c9190044e60a76d7df14a4f2a3f1eaf295e02cbd15e51bf0b479948c502baa7e
SHA5129539a484efa56ae251c868b1cd8ba3200c3c6173d343b670a7c36346bbe9f634a09cb928bd674ab729a485c582db80bc27c96e7952579a82581aa2f5fcf0baee
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmpFilesize
103KB
MD5bd3cd22293a807c247cb812c57182bbf
SHA1474ba49ddaf31fe9a9668ac4ff605d60e06c9f6d
SHA256c931fc4d62cf81e4d18859f3bc0887b47d8dd410262a6e7cfc4a6b5e39ac9f97
SHA5123665c10bcd6a16937591791b3ebbf1b23b2fb1ff0bcb96ba156698878d2b0ded58048a0b7c7f1fa28c687915db586bd4fdf58baa5361963df601befb0436e470