Analysis
- max time kernel
149s - max time network
123s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
25/05/2024, 03:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
- Size 80KB
- Sample240525-dldnmacd3w
- SHA256 c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c
- MD5 22ec8ce09d9e8f76a07a203c3f60e05d
- SHA1 aa90df2eff4a50809f90e39d564ba1779634b70b
- SHA512 d6e42b5b81c83248fc804d5df70ab281ac1a32894908a10ed1438e0921636f0e62558728e56e673dda00a7a93d40551544b3ce90e32dfaebc8b5b3b9a82429a0
- SSDEEP 1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhn:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsa
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (3443) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ashgabat.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Magadan.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\Rio_Gallegos.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_h.png.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_cloudy.png.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\7-Zip\Lang\uz.txt.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Amman.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\settings.css.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\alertIcon.png.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_cloudy.png.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\vignettemask25.png.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jre7\bin\jfr.dll.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\CST6CDT.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Microsoft Games\FreeCell\it-IT\FreeCell.exe.mui.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Windows Media Player\en-US\wmpnssui.dll.mui.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\cpu.js.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\7-Zip\Lang\mn.txt.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-filesystems.xml.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Kolkata.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\gadget.xml.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\fr-FR\gadget.xml.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet_3.0.0.v201112011016.jar.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.nl_ja_4.4.0.v20140623020002.jar.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color32.bmp.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Manaus.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_zh_CN.jar.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Ho_Chi_Minh.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\localizedStrings.js.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher_1.3.0.v20140911-0143.jar.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-io-ui.jar.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-settings.xml.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\settings.html.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.properties.src.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sendopts.jar.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_zh_CN.jar.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\currency.html.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_thunderstorm.png.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Palau.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Windows Media Player\en-US\WMPDMCCore.dll.mui.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\currency.html.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jdk1.7.0_80\LICENSE.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Microsoft Games\Solitaire\en-US\Solitaire.exe.mui.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libasf_plugin.dll.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libttml_plugin.dll.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-docked.png.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\settings.css.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\drag.png.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-gibbous_partly-cloudy.png.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jre7\lib\zi\America\Manaus.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationProvider.resources.dll.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\VideoLAN\VLC\plugins\spu\librss_plugin.dll.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssBackBlue_Undocked.png.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\gadget.xml.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini.tmp
- Size 80KB
- SHA256 16b9eddb55d58d59abbaf7c0de1371e75400a729c127b1e82df7c523d553208a
- MD5 12501831aebb73e7edfcc6236fa1f413
- SHA1 94f6f92c56296ea467671991e2ac234d781dd871
- SHA512 457f6b882a700728833491132c4c9fcb7cbf7c887bcacb21e968b7cae8d6c2637712bf9c2fa03c6f3c7fd2d60baa85aceffa56a33392a8108d040b2de4efc73e
- SSDEEP 1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhG:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
- Size 89KB
- SHA256 3f25230250bf4a76770abe5c0ac921e0205f71ac75a37feeb8c29d4aaab165b1
- MD5 db35465b2eee7f1add021a2c4ba1c320
- SHA1 bee40cfa7b466588cec6779ceb9f468cf43e55e2
- SHA512 6c395b6788f1b66803afea0771dd441e395f89bafb1528b01ef88101a7085a14a29abac7445b95c746dd62b8f33ed115e148118ff7abe23659f122007e16f8b3
- SSDEEP 1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhs:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsJ
- MD5 SHA1 SHA512 SSDEEP