Analysis
- max time kernel
150s - max time network
122s - platform
windows7_x64 - resource
win7-20240419-en - resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system - submitted
26/05/2024, 03:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe
Resource
win7-20240419-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe
- Size 78KB
- Sample240526-eghx8aeg28
- SHA256 df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c
- MD5 5f6ea5a00a1da4a01365ae5c2acf89f3
- SHA1 ba506acd701b46915caba5db9c05f5c24de3123e
- SHA512 07652559db253f951aa3b112813ef5d418c8e0ec4cc4ba259cbe9f2d3d33478d9624329db11f588780b24782ef4fd955d87ee28023e21d33c19e19718f6c133e
- SSDEEP 1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/2vw:6e7WpMaxeb0CYJ97lEYNR73e+eKZ9
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (3521) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-templates.jar.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Java\jre7\bin\javafx-iio.dll.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-utilities.xml.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Design.Resources.dll.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Windows Defender\ja-JP\MsMpRes.dll.mui.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\settings.html.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dushanbe.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.zh_CN_5.5.0.165303.jar.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-keymap.xml.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-conio-l1-1-0.dll.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\203x8subpicture.png.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_ButtonGraphic.png.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InputPersonalization.exe.mui.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_zh_4.4.0.v20140623020002.jar.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Microsoft Games\FreeCell\ja-JP\FreeCell.exe.mui.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\rings-desk.png.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\settings.js.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wallis.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\day-of-week-16.png.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-execution.xml.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiling.jar.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.Design.resources.dll.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcfr.dll.mui.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console_1.0.300.v20131113-1212.jar.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_zh_CN.jar.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_ja.jar.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Abidjan.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw32.jpg.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\7-Zip\Lang\ba.txt.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtau.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libinvert_plugin.dll.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Windows Defender\en-US\MpEvMsg.dll.mui.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\7-Zip\Lang\mk.txt.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Java\jdk1.7.0_80\include\classfile_constants.h.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\instrument.dll.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lord_Howe.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_zh_CN.jar.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-awt.jar.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\slideShow.js.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipRes.dll.mui.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\bbc_co_uk.luac.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_zh_4.4.0.v20140623020002.jar.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Hong_Kong.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Yekaterinburg.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\7-Zip\Lang\id.txt.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Linq.Resources.dll.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\libfloat_mixer_plugin.dll.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\flyout.html.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\settings.css.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_zh_4.4.0.v20140623020002.jar.tmp df7318ab9cc09beba4fa6e5cadb3ff3c0e76d8673520d741ef8f2ca4231a496c.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp
- Size 79KB
- SHA256 3f4982645438e5e3c6a5ec2b42bd33c606c480c9262904c283569223aaf63446
- MD5 2c102156060726c6ffd6ea7302e7f1ec
- SHA1 97e71d8e6b420d8c0d742328b379a33c99472a3f
- SHA512 5634b57fabd09a0e5a86406e03f92104fff968ec0e65eb70a7ed4f826d7db4fea6cb94f40345f1ecfe99006aa7f5cf14d2a7a7822229871325dbe5e2797d30d5
- SSDEEP 1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/2v7:6e7WpMaxeb0CYJ97lEYNR73e+eKZW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
- Size 88KB
- SHA256 bd9147a279013f58f27b9b9f7265d25387dcf28333ecd7c57cbf6742784bbb99
- MD5 8ac6a194b7e4c75294b8338923baac06
- SHA1 8ad87ee5ab998f3de779891e19f167ccc1fb4874
- SHA512 42807623e388e2bff86825b76eb231608dbb57d0ee56fa93892ccf40bbd5ba8e8054fd975148245c7bc724861893ea301380caf0e5560dc3d41ba8d1256f3ce7
- SSDEEP 1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/2vd:6e7WpMaxeb0CYJ97lEYNR73e+eKZY
- MD5 SHA1 SHA512 SSDEEP