Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
10-06-2024 23:11
Static task
static1
Behavioral task
behavioral1
Sample
6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe
Resource
win10v2004-20240426-en
General
-
Target
6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe
-
Size
80KB
-
MD5
368648faf5e1af5dc451aff87084db09
-
SHA1
3da0d32fca5a44f2dc12084c854b118c6252a4df
-
SHA256
6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f
-
SHA512
be9332ee9945cce500bd71dceadfd5ed1e39a5cc48f1ecbcf54bc7110a0afa75421e16a7c523fe59461bca952e80ad493b246d8b9f5f527686136b999b2e8c67
-
SSDEEP
1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhF:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsw
Malware Config
Signatures
-
Renames multiple (3532) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.analysis_3.5.0.v20120725-1805.jar.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-heapdump.xml.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Java\jre7\lib\zi\America\Chicago.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rainy_River.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Efate.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\vlc.mo.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Java\jre7\lib\jsse.jar.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Mozilla Firefox\locale.ini.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\graph_up.png.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\settings.js.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sa.xml.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Java\jre7\bin\dtplugin\npdeployJava1.dll.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\resources.jar.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Mozilla Firefox\AccessibleHandler.dll.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\slideShow.js.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sk.pak.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Whitehorse.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.zh_CN_5.5.0.165303.jar.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-attach.jar.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\calendar.js.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipTsf.dll.mui.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonIcon.png.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\flyout.css.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\vocaroo.luac.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-spi-quicksearch.xml.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libcaca_plugin.dll.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\picturePuzzle.js.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\picturePuzzle.html.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-attach.xml.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\DVD Maker\soniccolorconverter.ax.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Internet Explorer\D3DCompiler_47.dll.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\ja-JP\gadget.xml.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\drag.png.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)alertIcon.png.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\WriteDeny.wmv.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Omsk.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench_1.2.1.v20140901-1244.jar.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Windows NT\TableTextService\TableTextService.dll.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\graph_over.png.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Star_Full.png.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\vlc.mo.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libaes3_plugin.dll.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Detroit.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_zh_CN.jar.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Windows NT\TableTextService\fr-FR\TableTextService.dll.mui.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\tipresx.dll.mui.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_zh_4.4.0.v20140623020002.jar.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-cli.jar.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-outline.xml.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Java\jre7\lib\management\snmp.acl.template.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxml2.dll.tmp 6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81KB
MD51f3ed9837c83a3d9c552bbc06f792cb9
SHA1492ae47e7ea980f04a1f805789389afa1ad1f80f
SHA25629f8b236c871ee8f01fdb11c1ad9856007e96ad46d3804fc7c2281964ab06367
SHA512973d3cf62a314a3d45d0a2e7ea7d281c8392dc0d406c403f6bd29b4527a5020f16282a5c7d4cb469ee532e076afacb54f65af01aadda678807417c8a430395c2
-
Filesize
90KB
MD52a3d72dfadb9e6484df5ee3b01af69bf
SHA1cda0ed699276a44807f6885e0d08d60da315a9ba
SHA2562afae16f53026e52de49ad29f4c5d8dfe12686865568a2f512a9bb4413314abb
SHA512b997b4300e275a9a79c7919afb9d89994b93736c4fcb59d352810bfc5f786f61934705a03d9696163ee9f4f0f06c575f2989f48d76615a3c91c16e65796d2a27