f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 05:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
Size

89KB
MD5

93cd221dda3847316ac1a1405dd53de5
SHA1

e8e47e9650f94c2b9d8d86d4654057249c358c80
SHA256

f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70
SHA512

1e95472ed3f692f8abf2ff0d8439219d4a2a48cf29cd3051e056245f09513d5526983f33087970146a34b11d88757b0ddc307c43eb124b1ba338143bc5b429d0
SSDEEP

1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPq6:6rWpcOPxPke+e3fFpsJOfFpsJbgEx

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3487) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Saipan.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-search.jar.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\pop3.jar.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Windows Journal\it-IT\JNTFiltr.dll.mui.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\service.js.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.zh_CN_5.5.0.165303.jar.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_zh_CN.jar.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_ja.jar.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Windows Defender\MpCmdRun.exe.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Windows Journal\de-DE\jnwdui.dll.mui.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Internet Explorer\jsprofilerui.dll.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.zh_CN_5.5.0.165303.jar.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mip.exe.mui.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Rankin_Inlet.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\DVD Maker\sonicsptransform.ax.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\tzmappings.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sendopts.xml.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Windows Media Player\Media Renderer\DMR_48.jpg.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-gibbous.png.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Havana.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_ja_4.4.0.v20140623020002.jar.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-execution_ja.jar.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\settings.css.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_ButtonGraphic.png.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_mac.css.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Windows NT\TableTextService\en-US\TableTextService.dll.mui.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\gadget.xml.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\settings.js.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\settings.js.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\highDpiImageSwap.js.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-ui.xml.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup-impl.xml.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Java\jre7\bin\glass.dll.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_delay_plugin.dll.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\hint_up.png.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_fr.properties.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_zh_4.4.0.v20140623020002.jar.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_ja.jar.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Magadan.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\gui\libqt_plugin.dll.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_mmx_plugin.dll.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\nio.dll.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Boa_Vista.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Martinique.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\vlc.mo.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\uninstall.log.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\vlc.mo.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ca.pak.tmp	f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe

C:\Users\Admin\AppData\Local\Temp\f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe
"C:\Users\Admin\AppData\Local\Temp\f1a01868ca93625d2d67bf4c06052f81e2052e8b0ae93004a68e01b944124e70.exe"
1⤵
- Drops file in Program Files directory
PID:1904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.tmp

Filesize
90KB

MD5
d602fef84ba9eba6f88dbbde404ea2fe

SHA1
31a4e6e6ba05f798c263b3d64424a991e4007628

SHA256
59425c8a003b10161c025828e7f6d3b8a46ff02ab978ffc3399ff2d6bb8c2d2e

SHA512
d48cf60c8ba467d836da17f6482f6b4447cce81dd7cfb8090b1379de517e22d861c774b9a1cd3524e8d248ac70fb0afeacc8c6cffbd130741d27a8d46fd7245c

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
99KB

MD5
f771354c89a13f81c8616bd8f9e2dab8

SHA1
3520ffba9a6bb6aee838b3c8c35440e7bb8f7330

SHA256
8e83af66e78301ffd25760001445b21b87c322224d2520e3096e5cc0a0953700

SHA512
533e0ce23618d19b682d3cfa504aee1b150bed46a9090e36bdd9387aa05398b7748816d0d2a5a528075be4ccc56b8524ae771e8745f44bb79da4ba9eb2d04273

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads