Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 22:33
Static task
static1
Behavioral task
behavioral1
Sample
63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe
Resource
win10v2004-20240508-en
General
-
Target
63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe
-
Size
50KB
-
MD5
88f3d3ca020ea2a746fddb13186b4d31
-
SHA1
ce32c1351bfd6c0ce84c34fa9d4525e1613e9423
-
SHA256
63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e
-
SHA512
c6d833654e2b024d5b99c8554675d6e82948741c396d28f4eb34f3ed55c39172176579f7c81083f11fb2cb46f9ffc6f4336083a4194f61cf01560889c8fa4034
-
SSDEEP
768:W7BlpNLpARFbhblkYlkrt8PWGoPWGqMs1MsR5nd5nz:W7ZNLpApCZrt8PWGoPWGANdNz
Malware Config
Signatures
-
Renames multiple (3782) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exedescription ioc process File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-output2.xml.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\MST7.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\next_rest.png.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prcr.x3d.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.ja_5.5.0.165303.jar.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\VideoLAN\VLC\plugins\keystore\libfile_keystore_plugin.dll.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\settings.js.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_vc1_plugin.dll.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\settings.js.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ViewerPS.dll.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tabskb.dll.mui.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-font.dll.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegaudio_plugin.dll.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_zh_4.4.0.v20140623020002.jar.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_ja.jar.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Simferopol.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\info.png.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_SelectionSubpicture.png.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Karachi.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Conversion.v3.5.resources.dll.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Java\jre7\lib\deploy\messages_es.properties.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Easter.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application.xml.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Microsoft Office\Office14\OLKFSTUB.DLL.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\row_over.png.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\settings.js.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\DVD Maker\it-IT\OmdProject.dll.mui.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576black.png.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Java\jre7\lib\fonts\LucidaSansDemiBold.ttf.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\micaut.dll.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.jobs_3.6.0.v20140424-0053.jar.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_blu.css.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-queries.xml.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Guadalcanal.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_sse2_plugin.dll.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Ushuaia.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\1047x576black.png.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\imap.jar.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\VideoLAN\VLC\lua\extensions\VLSub.luac.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\hxdsui.dll.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\7-Zip\7-zip32.dll.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_ja.jar.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\VideoLAN\VLC\plugins\logger\libfile_logger_plugin.dll.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Windows Defender\MSASCui.exe.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.commons.logging_1.1.1.v201101211721.jar.tmp 63696c9eb066e0a7c41bd9e99ce820344488c3d984b9e2eb9417675deb91df6e.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmpFilesize
51KB
MD5cdbbe3334d0bbdcde0935eaf54f5b172
SHA16dd0327fa4f3a2c60074f683391763eece2149f2
SHA256ad38760e9bd17db29677508f8e5315d4e75d847a24745eafef21370527116442
SHA512fb1d25998e71e2af83de143c26a0f0ad820789709071a12056b5891406b2247b1ffc1054a884f7e64afd5d418c39bd709de23a65bbb4034c06f9dbad11a953a2
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmpFilesize
60KB
MD50d6ec554c5b114c48b65306a5e189834
SHA167f3c93be746ba9ca56f87552943250b1aa59b2a
SHA256b4d3c36baaa93005cd3e8bbda5c1baad397fa230fac900c51d3d7c7fecf73bec
SHA51201969d653306ca31a7ec27230e1415cf6406560fc0f5dd178831eb013a70946b1d2b1abda4b4cccfeda0a75d45785b17c9bfc597e7b89039fba284c222340c63