Analysis
- max time kernel
150s - max time network
118s - platform
windows7_x64 - resource
win7-20240220-en - resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system - submitted
30/05/2024, 04:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
- Size 74KB
- Sample240530-e8ttsseh2v
- SHA256 eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36
- MD5 2cb0493debfe2913417682dcedb18e77
- SHA1 046d68ffa7596e2f3ab00c221873aa8e3616ff49
- SHA512 c8e55aa200e4d856ca145da5f6e637e3d68a0ec3e8e835eff058eda3d4c988bbf37af28c21c5a8209468fcb4f9871ae26147ab0be52056456d41db9d1eae779f
- SSDEEP 1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhe:6pWpUFpEhLfyBtPf50FWkFpPDze/qFs3
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (3430) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.contexts_1.3.100.v20140407-1019.jar.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Java\jre7\lib\zi\America\Dawson.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-conio-l1-1-0.dll.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guayaquil.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\bckgRes.dll.mui.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libtwolame_plugin.dll.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-loaders.xml.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\1047x576black.png.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Java\jre7\lib\zi\America\Resolute.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Aqtobe.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qyzylorda.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sampler.xml.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Java\jre7\lib\javafx.properties.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\CompressInitialize.edrwx.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Kwajalein.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.lnk.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hi.pak.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tongatapu.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\Marengo.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Microsoft Games\Solitaire\it-IT\Solitaire.exe.mui.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.servlet_1.1.500.v20140318-1755.jar.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Microsoft Games\Minesweeper\en-US\Minesweeper.exe.mui.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.json.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_wav_plugin.dll.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tripoli.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Java\jre7\README.txt.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_zh_4.4.0.v20140623020002.jar.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\7-Zip\Lang\fi.txt.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Sakhalin.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.SF.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\libxml_plugin.dll.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-io-ui.jar.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\7-Zip\Lang\sa.txt.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_ja.jar.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IdentityModel.Resources.dll.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\librtpvideo_plugin.dll.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\VideoLAN\VLC\plugins\keystore\libmemory_keystore_plugin.dll.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\DVD Maker\DVDMaker.exe.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\accessibility.properties.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-multitabs.xml.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\travel.png.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Java\jdk1.7.0_80\COPYRIGHT.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Xml.Linq.Resources.dll.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\core.jar.tmp eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmp
- Size 75KB
- SHA256 cfec7fe137a7752db32d3c394b498bdc04f86d93f1952802726d2dfbbd7a0b34
- MD5 705dbba421b03b8eca3e92071cc820a0
- SHA1 824fa9be271987f52dc4b0e2d319ec5550a50e6e
- SHA512 88fdfd698ec557a17c6c4a7b6e101dc42732f94d8147e71d382b62be099d038e034f801ade13115d08950992f2cfd90a6d32b4db8f874973992b831438284f38
- SSDEEP 1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhS:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
- Size 83KB
- SHA256 78ddc5d4e2ad702a27cc8b5328779fc4df9c44a09cc533424d25c53a5b4f5566
- MD5 f7df8ad2318817b32c989dc46898f627
- SHA1 4ef97437179c96dfe426fe960e44ae7829b7416d
- SHA512 9753a3b28bca28fe045d05a04c9a20cdf489b4bddf27e7e8d45c9a673ae34dbe1ff687cc5b3a0d5d9c27a95fe45fdfe8c55cd8e314f3d4fabead532933152db4
- SSDEEP 1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhA:6pWpUFpEhLfyBtPf50FWkFpPDze/qFs9
- MD5 SHA1 SHA512 SSDEEP