45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
Size

87KB
MD5

fb3aec9e8345aa40e4311e7403861cce
SHA1

f88b11e2de16a2f978dfc527be5237de31ad6dbd
SHA256

45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89
SHA512

776c2563c88ff6fb441eca19f02cdfee672c9743bc004e0cf5dc4155476fceb4c15e86f2a9887fb1859af189ac34b19a329b3c7f659ba6837268cf42e948d597
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEh+:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsr

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3447) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\ContentDirectory.xml.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\ConvertUnprotect.inf.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sendopts.jar.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-snaptracer.xml.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_zh_CN.jar.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\vignettemask25.png.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Dublin.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkHandle.png.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Windows Media Player\ja-JP\wmpnssui.dll.mui.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)notConnectedStateIcon.png.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_zh_CN.jar.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuy2_i420_plugin.dll.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-visual.xml.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring.jar.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-visual.xml.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\03_lastfm.luac.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_srt_plugin.dll.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tabskb.dll.mui.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Windows Media Player\es-ES\setup_wm.exe.mui.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_hov.png.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-new.png.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\library.js.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Monaco.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Mozilla Firefox\application.ini.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Mozilla Firefox\msvcp140.dll.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayenne.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\jvm.lib.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\MANIFEST.MF.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages.properties.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\DVD Maker\DVDMaker.exe.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-over-DOT.png.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.lnk.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-math-l1-1-0.dll.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_av1_plugin.dll.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Andorra.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Windows NT\Accessories\ja-JP\wordpad.exe.mui.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_down_BIDI.png.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.RSA.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Nipigon.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Microsoft Games\Hearts\it-IT\Hearts.exe.mui.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jayapura.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tallinn.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpcore_4.2.5.v201311072007.jar.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Windows Media Player\de-DE\mpvis.dll.mui.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\picturePuzzle.html.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\logo.png.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipRes.dll.mui.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_ButtonGraphic.png.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\settings.html.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-filesystems.xml.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Microsoft Games\Mahjong\en-US\Mahjong.exe.mui.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
File created	C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui.tmp	45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe

C:\Users\Admin\AppData\Local\Temp\45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe
"C:\Users\Admin\AppData\Local\Temp\45a5113aa1ff208d538281a36628705c3bb0c8e35e38cd4bad50d9ef21edfa89.exe"
1⤵
- Drops file in Program Files directory
PID:952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini.tmp

Filesize
87KB

MD5
eb1844720c0716eaaf571c9354ae956e

SHA1
fcee58e3ba3d3c1fe9a7db56cf2b192d5e1003d3

SHA256
0c89fadbad5148ce58b3aff1e7b0bbec6dbeaf06fe09375453c80fe64f379b76

SHA512
4bd537890bec62b78032748939dad6245d066277ef71efc7dd2452c8de7d0f146b41fc0900a03220a1f537389af12bcd64cb012872c4ee0a1885bc854abac21d

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
96KB

MD5
ca570e63a59ee65a67af286cd94d8834

SHA1
ec29be2d2a0aafdb28270100af97a75164979399

SHA256
653b66ff36eb7b8266992f1c2a3d89bf10eb44dfba7030b4ec8df200eed7317c

SHA512
e5e4fc0c85c03914234c17aacc6bdf8c584104b4b23675707704cb2b7200136d987d2734fb0f1a92aefcbdec2118df3d6dbf37d054736c693be38dc903f0b362

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads