0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 18:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
Size

133KB
MD5

066e12350f45e5a4f8d59165ba539147
SHA1

77fa84f84229fc0490b72fcd311e778e255374a7
SHA256

0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652
SHA512

addfb01b7e721002b80819feddedfcf1ebdfb30802ed69580f9b6f04cbdcfaef5674279c4c65cf6dd1c61129f375bd37bcbacf2065f5c00bc317fc8e35f54b0f
SSDEEP

768:/7BlpQpARFbh2UM/zX1vqX1v+1WbW1rjrA9ZONZOD5ZTXB85c5cfYfP:/7ZQpApUsKiX26f

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3449) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator_3.3.300.v20140518-1928.jar.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_zh_CN.jar.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Design.Resources.dll.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\vlc.mo.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPHandle.png.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Aqtobe.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jre7\lib\zi\MET.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_streams.luac.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libvcd_plugin.dll.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.ssl_1.1.0.v20140827-1444.jar.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\vlc.mo.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_SelectionSubpicture.png.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\alt-rt.jar.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Baghdad.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_ja.jar.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_ja.jar.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Windows Journal\NBMapTIP.dll.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\DVD Maker\de-DE\DVDMaker.exe.mui.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.war.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.dll.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_imem_plugin.dll.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpclient_4.2.6.v201311072007.jar.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_zh_CN.jar.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Magadan.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Maldives.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Microsoft Games\Mahjong\es-ES\Mahjong.exe.mui.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ko.pak.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kabul.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UCT.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Microsoft Office\Office14\INLAUNCH.DLL.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\liba52_plugin.dll.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_flac_plugin.dll.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mlp_plugin.dll.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jre7\bin\javafx-iio.dll.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Sydney.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Microsoft Games\Solitaire\fr-FR\Solitaire.exe.mui.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\license.html.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding_1.4.2.v20140729-1044.jar.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.server_8.1.14.v20131031.jar.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Brunei.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\libmosaic_plugin.dll.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.ServiceModel.Resources.dll.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\vlc.mo.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder_5.5.0.165303.jar.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jre7\bin\verify.dll.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightRegular.ttf.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt_0.12.100.v20140530-1436.jar.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Campo_Grande.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuvp_plugin.dll.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Kerguelen.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-compat.jar.tmp	0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe

C:\Users\Admin\AppData\Local\Temp\0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe
"C:\Users\Admin\AppData\Local\Temp\0689c0bb9ddfb45ad88517e6f602b47b1edd749e258642bf3d4837202f874652.exe"
1⤵
- Drops file in Program Files directory
PID:1196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini.tmp

Filesize
134KB

MD5
33af80d86ccbc2285270ac222c3f0a70

SHA1
52dc9f441561c82ff72a7ac87690d9b765afff3c

SHA256
f79616ad3eb44b79f70c705ae24923050090041a026230d85efe163656219b97

SHA512
f14e356b309a4199e8f40de73eb67e414b6242a106b6e6b372d431f6b699e1e02d1518704771423e260d02f3c817f6fc20ad2170389fc40187c2305ca28a6607

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
143KB

MD5
adbeb01c232a02293f7e254a74c6f779

SHA1
d21ee6db13573d55e6dc67a90564c0e7eeff34b4

SHA256
765260829ebfdec5cbf4faac156ea6bae46360f1769be1c8c554f6801577e82c

SHA512
550581ab23c5548ba0bdcb0354edf152403fca2a9a1e451292ecf16a662ee9f38f6b6539fbb806b4e2b986484b025414deddc6b242b7e45bfabf9511176e3e36

Download Submit
memory/1196-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1196-582-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads