Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/06/2024, 01:47
Static task
static1
Behavioral task
behavioral1
Sample
1b36162ad762d667dc8d71b1c31aed40.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1b36162ad762d667dc8d71b1c31aed40.exe
Resource
win10v2004-20240508-en
General
-
Target
1b36162ad762d667dc8d71b1c31aed40.exe
-
Size
31KB
-
MD5
1b36162ad762d667dc8d71b1c31aed40
-
SHA1
d1f4085b24722705c76c251dd02d7d0915c21941
-
SHA256
d1c54c2b333100d19458d0fb2f37f20c1199e3200a4e535e4f7ae0439b325b95
-
SHA512
ba648d89b4bd3b7d062830c53746bfd537ac3151ce65095d81ce7580eeebd827f14df4747752c79d3b71b6403514cf68a5707c8ee153a80d844c52a221920aa4
-
SSDEEP
192:tACUADIY0Br5xjL/FAgAQmP1oynLb22vuN6GnN6GDb0jKS5b0jKS/:GBt7Br5xjL9AgA71FbhvuNBNz6Y
Malware Config
Signatures
-
Renames multiple (3845) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dili.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-lib-uihandler.xml.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jmx.jar.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libfluidsynth_plugin.dll.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\clock.js.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-crescent_partly-cloudy.png.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_top_left.png.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net_1.2.200.v20120807-0927.jar.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\Keywords.HxK.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Microsoft Games\Hearts\ja-JP\Hearts.exe.mui.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\settings.css.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClientsideProviders.dll.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Windows Journal\jnwmon.dll.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\wsdetect.dll.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_zh_CN.jar.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-common.jar.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\vlc.mo.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgradfun_plugin.dll.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-api.xml.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ACE.dll.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\ZoneInfoMappings.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-over-DOT.png.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_bottom_left.png.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libfreeze_plugin.dll.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\7-Zip\Lang\ext.txt.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_plain_Thumbnail.bmp.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirectdraw_plugin.dll.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\DVD Maker\bod_r.TTF.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\GRAY.pf.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Kiev.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Bougainville.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libdshow_plugin.dll.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\liba52_plugin.dll.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_zh_4.4.0.v20140623020002.jar.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libvnc_plugin.dll.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libspdif_plugin.dll.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\7-Zip\Lang\fi.txt.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\platform.xml.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_plugin.dll.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Goose_Bay.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Star_Half.png.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\7-Zip\Lang\lij.txt.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.bat.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.fca.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\mojo_core.dll.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\speaker-32.png.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-io-ui.xml.tmp 1b36162ad762d667dc8d71b1c31aed40.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\liblogger_plugin.dll.tmp 1b36162ad762d667dc8d71b1c31aed40.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD5e640b3c7c41ea4c91cb8e7bdbf83a22e
SHA135e559e71a4f3607ef5475f5004335c00fbd1f0f
SHA256cd8700c925047647f40e656b717354274da891d78d41d2ee540b2c3dde57854f
SHA512297e344abded2143ff4db8c85e650e452f7d5412564d09c7cd6500c4f08fd834eb637e4415834556b5de1234031ad4f9770ccd5e76b76b60553be547f8d75b62
-
Filesize
41KB
MD5777b1ce61784eaa32ae68854b364e3df
SHA1f81ca847223edaf3b554336c6f06987f009d7f37
SHA256b85fbede67a8778a690738d4f852b033b3c7cca22e85f2d918a78c5db3b1b37b
SHA5123a258fad744a26dd58a7d5fe21ee63b9d8a086237a4bde69de6155769cb772d9449b3d93a75815587e4fda1186dd80a2e6e1f1886d34b9f37789a3ae4c199b34