Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 21:42
Static task
static1
Behavioral task
behavioral1
Sample
50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
Resource
win10v2004-20240426-en
General
-
Target
50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
-
Size
94KB
-
MD5
1fecaba988a6d8ff551bb77e26936ab2
-
SHA1
7242ffa256efaa71fc55d8ef2b9c8bc40636b43a
-
SHA256
50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac
-
SHA512
2ea3c5c16ec500998fbf5031a99a3e7feed71ad7dd2a28b7094d48418ed6fc77f04bcc0d24d7e32f96813f10cc43cbe6ac321660c874623f7b139b58ec55e0c6
-
SSDEEP
1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/ey1Sy1BJ87J8H:6e7WpMaxeb0CYJ97lEYNR73e+eKZPVX
Malware Config
Signatures
-
Renames multiple (3423) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exedescription ioc process File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+4.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.el_2.2.0.v201303151357.jar.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-oql.xml.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jre7\lib\zi\America\Havana.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IO.Log.Resources.dll.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_rest.png.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Macau.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationBuildTasks.resources.dll.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libtospdif_plugin.dll.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_m.png.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\gadget.xml.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kathmandu.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-modules_ja.jar.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jre7\bin\dtplugin\deployJava1.dll.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Tongatapu.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\vlc.mo.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\picturePuzzle.js.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Lima.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santiago.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jre7\bin\JAWTAccessBridge-64.dll.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Seoul.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Windows Media Player\ja-JP\WMPDMCCore.dll.mui.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_ja_4.4.0.v20140623020002.jar.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-fallback.jar.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Bangkok.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Novosibirsk.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_ja.jar.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jre7\bin\libxml2.dll.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\shatter.png.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfontj2d.properties.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgzm.exe.mui.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\7-Zip\7zCon.sfx.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_ButtonGraphic.png.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoBeta.png.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\7-Zip\Lang\bn.txt.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libjpeg_plugin.dll.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libwebvtt_plugin.dll.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\7-Zip\Lang\va.txt.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-background.png.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\alert_obj.png.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_preferencestyle.css.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jre7\bin\wsdetect.dll.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Urumqi.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitevignette1047.png.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\ZoneInfoMappings.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.properties.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app_1.0.300.v20140228-1829.jar.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\init.js.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application-views.xml.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_zh_CN.jar.tmp 50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.tmpFilesize
95KB
MD5324be5a9086b552472547f49a7f620ac
SHA1a4ab381501e95c144f13b2b91d9b3e630da93bf2
SHA2566609748e3b98d254d296af73f10b33caed5e6b146a03b5624a3a765d7c7abf23
SHA512b1ede4eedbbb09c20f8979c908b7ad1341094930374603f6577b5166516e76bbc9a60455ae6aa22b55b5fa0cfde95828d50fee0fa914c3db3eed5c9bccad3b92
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmpFilesize
104KB
MD5492cc586245f3ccfd0eb768bf5666a88
SHA1f00c580fbbbb36e69ccce9d0eda725272ea066ec
SHA2568fdc524d3357690209b4fe48b64f3c1a93a5ed171a42b8ea8df1426dc1b0da85
SHA5121adb8821598b4d6433dc4b6ca2073c20e4888cbf9dcf85d7da1e8b2ad900f8e130979c39402dd3ae42d68f2377b85dedec29493e9ff6033d0691cbf3ada2d0d5