Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/06/2024, 04:02
Behavioral task
behavioral1
Sample
b9e7395823b4fba1a5df241416ca2620.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b9e7395823b4fba1a5df241416ca2620.exe
Resource
win10v2004-20240226-en
General
-
Target
b9e7395823b4fba1a5df241416ca2620.exe
-
Size
80KB
-
MD5
b9e7395823b4fba1a5df241416ca2620
-
SHA1
0c3eba96466523d1198b0eacbba9aa578321a791
-
SHA256
d5d2b5b9b359f71c3b36d48da613b35d5550fe7df0a08f99367fe7a2e4c0c149
-
SHA512
718d32ecf6217ea1bec96cee232700e80fa4b5d2cb45fa8b25d99198f463d92ef9fd27bb2bb05d6c3aace86e1032dfe73e50b01b4a483432ebd49aa4d10d134c
-
SSDEEP
1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxkqGUBM+PocOQOFPdMRAHAASnnD5D5K:+nyiQSojUBM+PocOQOFPdMRAHAASnnDa
Malware Config
Signatures
-
Renames multiple (3534) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2476-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000b000000015bb9-2.dat upx behavioral1/files/0x00020000000106dd-6.dat upx behavioral1/memory/2476-652-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-settings.xml.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Windows Media Player\de-DE\wmpnssci.dll.mui.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\classlist.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore_2.10.1.v20140901-1043.jar.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor_1.0.300.v20131211-1531.jar.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Java\jre7\lib\cmm\sRGB.pf.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_bottom_right.png.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\7-Zip\Lang\va.txt.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_SelectionSubpicture.png.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core_0.10.100.v20140424-2042.jar.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\cloud_Thumbnail.bmp.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationCore.resources.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_settings.png.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipRes.dll.mui.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_ja.jar.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Uzhgorod.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\VERSION.txt.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libvpx_plugin.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\9.png.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipBand.dll.mui.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\DismountConfirm.vdw.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novosibirsk.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\13.png.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_zh_CN.jar.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-startup.xml.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Java\jre7\lib\zi\America\Goose_Bay.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Java\jre7\lib\zi\America\Los_Angeles.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\manifest.json.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodbig.gif.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Windows Defender\fr-FR\MpEvMsg.dll.mui.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-docked.png.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Stockholm.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Mozilla Firefox\defaultagent_localized.ini.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_down.png.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-api-caching.xml.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial.png.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4ADT.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-fallback.jar.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Java\jre7\LICENSE.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libadf_plugin.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Sydney.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ml.pak.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Danmarkshavn.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychartplugin_5.5.0.165303.jar.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_zh_4.4.0.v20140623020002.jar.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util.xml.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Microsoft Games\Chess\ja-JP\Chess.exe.mui.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXSLE.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Java\jre7\bin\verify.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD5fc74742fc0f97190668cfd75df277a30
SHA16a65fe741c0f5522722e480fdbc83ad3bb70b177
SHA2561f34253f4d61d634267b4dd3c863e93fd6b37ccca393ee48ab9749b6a60373fc
SHA51226479b6fecd61740c03af8c4dcfced4dd5c7afc658de339bc78c37924e0cdcb4fab952995cbce916cbe1d76b294b8a3ea91512f2719911bedca43cf3ab17fed9
-
Filesize
89KB
MD5cbf9d529fb521a160361da79342be21a
SHA1febe153ab269ef645116240e1df10ae67c95bc44
SHA256d0798e90026d24044ce6804262c4afb32d3dc1349ba36f4210ae59aaa9bdc9d2
SHA512ab06d041dc33e9f039c960d8c6e790553c0057bc369bdd0261cbf1bbaf2438c82c9cd5a419c86ce9dcb33eb8c829c05f8fbf023a4b3bf2197afd38eb7e9f3ccb