af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 01:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
Size

31KB
MD5

95b868480b35ae712e52fb99522d8928
SHA1

467ee2dc16f7a43642548659a3f3d600969223db
SHA256

af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543
SHA512

4c5f7186274652e60450351332b4bf90090539348e7dcd9af2a8c732478437b436c86cc3078b48a41b48c0cdf7631e00efc91752be31ace858a0f75e5c2d50f0
SSDEEP

192:tACUADIY0Br5xjL/FAgAQmP1oynLb22vuN6GnN6Gx:GBt7Br5xjL9AgA71FbhvuNBNv

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3767) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Photo Viewer\PhotoAcq.dll.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double_orange.png.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\currency.js.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked-loading.png.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\classfile_constants.h.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives_1.1.100.v20140523-0116.jar.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_shout_plugin.dll.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Windows NT\Accessories\de-DE\wordpad.exe.mui.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_ja_4.4.0.v20140623020002.jar.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-core-kit.xml.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-nodes.jar.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Detroit.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Galapagos.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-snaptracer.jar.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Windows Journal\es-ES\Journal.exe.mui.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_close_down.png.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-time-l1-1-0.dll.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationTypes.resources.dll.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-full_partly-cloudy.png.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Beirut.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-ui.jar.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-utilities.jar.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Microsoft Games\Hearts\ja-JP\Hearts.exe.mui.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\vlc.mo.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_close_over.png.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresslm.dat.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME.txt.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_zh_CN.jar.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\shvlzm.exe.mui.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\timeZones.js.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\clock.html.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Chita.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_zh_CN.jar.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_description_plugin.dll.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\.lastModified.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Reykjavik.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libstl_plugin.dll.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libcaf_plugin.dll.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Windows Media Player\it-IT\wmpnscfg.exe.mui.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_disabled.png.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\47.png.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Internet Explorer\pdm.dll.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Swift_Current.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_foggy.png.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-spi-actions.xml.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\ChkrRes.dll.mui.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Microsoft Office\Office14\OLKFSTUB.DLL.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_close_down_BIDI.png.tmp	af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe

C:\Users\Admin\AppData\Local\Temp\af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe
"C:\Users\Admin\AppData\Local\Temp\af204647404b2fd776bf098c4b7befe2016cb75824040747286c91301f5af543.exe"
1⤵
- Drops file in Program Files directory
PID:2136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini.tmp

Filesize
32KB

MD5
871b124637c84987782543a913fba2c5

SHA1
6bae665b194465d9895ac53d0fac957a8c96d198

SHA256
ea4c2749e534aae95cda85e245c30e44dd4aff1ab4957ca8ab9af91ae5367c2b

SHA512
fc8c33f447c069d8e90cf0e3cc883d737f8010d2aa7e76ac6bbb9fe29353fb80f32bd31be3b8c713e516fd0ff296db6bfb1b35fbda6c61d92d62a7059cebb993

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
41KB

MD5
2f1c10097470951c810b593bc3cf375b

SHA1
803b25ca778bc63e6a10486fc5fe8bcda2701d43

SHA256
7d2d93fcee31f3840a9b5fac04777734d5d008c744b912c6091092d2492e2bbc

SHA512
2c87ebd1ffa5c891162c66722eee434cc5a1ccd9edfb81455bb907aaf211bc2787021448789ba02c629acfbc682e02c1aa12c83e946eb88b82a30f97531cc972

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads