Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 23:17
Behavioral task
behavioral1
Sample
7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
Resource
win10v2004-20240508-en
General
-
Target
7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
-
Size
63KB
-
MD5
4024724b719c7c623b100e21c0abf29b
-
SHA1
fb96bf14cf15427baf2891b69245b2b73e835660
-
SHA256
7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545
-
SHA512
b5c738c967291511046c3e356f4035964d9892f6170b2ccb973d0451f84b58a9d13ef2b696c6aa8863ac59ed484f1082d3aa99aa5c5364a278aa5c364f5a7fe9
-
SSDEEP
768:67Blpf/FAK65euBT37CPKK0SjHm0CAbLg++PJHJzIWD+dVdCYgck5sIZFufGWQMK:67Zf/FAxTWY1++PJHJXA/OsIZeGd
Malware Config
Signatures
-
Renames multiple (3636) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
UPX dump on OEP (original entry point) 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2336-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini.tmp UPX C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp UPX behavioral1/memory/2336-648-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
Processes:
resource yara_rule behavioral1/memory/2336-0-0x0000000000400000-0x000000000040B000-memory.dmp upx C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini.tmp upx C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp upx behavioral1/memory/2336-648-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exedescription ioc process File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-full.png.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\send-email-16.png.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-impl.xml.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-core.xml.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Java\jre7\lib\zi\America\Rankin_Inlet.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse_2.1.200.v20140512-1650.jar.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\ReachFramework.resources.dll.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Windows Media Player\it-IT\wmlaunch.exe.mui.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_win7.css.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\high-contrast.css.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-io-ui.jar.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_settings.png.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\localizedSettings.css.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.metadata.repository.prefs.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-applemenu.xml.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Java\jre7\bin\orbd.exe.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+10.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\settings.css.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\slideShow.js.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_foggy.png.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\DVD Maker\es-ES\DVDMaker.exe.mui.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Cairo.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Reunion.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Net.Resources.dll.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\gadget.xml.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-execution.xml_hidden.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\PST8PDT.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Windows Media Player\fr-FR\WMPMediaSharing.dll.mui.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-new.png.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pe.dll.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_dot.png.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw32.bmp.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\7-Zip\Lang\id.txt.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Kamchatka.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.dll.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mpjpeg_plugin.dll.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\7-Zip\Lang\pl.txt.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\jsse.jar.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Java\jre7\lib\zi\MST7MDT.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\liberase_plugin.dll.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Java\jre7\lib\alt-rt.jar.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\help.gif.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.xml.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libscte18_plugin.dll.tmp 7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini.tmpFilesize
63KB
MD5f281d6925f263198159cce1f39fa6ea7
SHA162e4499406bded9df78b1e8c3fa72f00b7351d01
SHA256f3dfcd328e64f781ef20232bf12a98f0e611a242ebf14fae25d2f7d4f5b78d87
SHA51283ea7b073409042246260b2efc67a5c72303acb498ead62d6ba2b5a374cbc045ec3e4c5d3eb5640853001f6068b8ae8deda18bda7b9aec1e18d0ae52aa0d33e5
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmpFilesize
72KB
MD5e9eeb2483c4594534b18cff7d4b15380
SHA1918cd8ce88d00383c5ae82eebdcb53a1d345647b
SHA256483074094d0028e7dc995ba726289638bf6acafb8254c9360423110a9885047b
SHA51234e9c138288ed51ec39e59bd1fbadc128e0306067beeac60bad6b0f48cdeca05da88d5bd44dfbf84b83365cb96ab45ce574d38681b4909181994d86f7251b941
-
memory/2336-0-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2336-648-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB