Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-06-2024 23:21
Behavioral task
behavioral1
Sample
715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe
Resource
win10v2004-20240508-en
General
-
Target
715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe
-
Size
47KB
-
MD5
8078c8dcc4d11913c6673a89ad3cd67b
-
SHA1
7ee36c998067cae6428b6888de456d544f77a126
-
SHA256
715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299
-
SHA512
1e70c8805731aa1fa318f92f8f22ee566a4ed726ef0635bb87a43e3ce745c9ebb4ca36d5348eeb5d10ff3dce57a2fd2025370c49458604dfef8d53c8b85e7595
-
SSDEEP
768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzg:CTWn1++PJHJXA/OsIZfzc3/Q8zx6
Malware Config
Signatures
-
Renames multiple (3728) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral1/memory/2988-0-0x0000000000400000-0x000000000040A000-memory.dmp UPX behavioral1/files/0x000d000000012350-2.dat UPX behavioral1/files/0x0002000000010674-6.dat UPX behavioral1/memory/2988-76-0x0000000000400000-0x000000000040A000-memory.dmp UPX -
resource yara_rule behavioral1/memory/2988-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000d000000012350-2.dat upx behavioral1/files/0x0002000000010674-6.dat upx behavioral1/memory/2988-76-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_ja_4.4.0.v20140623020002.jar.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\settings.css.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_zh_CN.jar.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.ServiceModel.Resources.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_mosaic_bridge_plugin.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_ja_4.4.0.v20140623020002.jar.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jre7\lib\management-agent.jar.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\VideoLAN\VLC\lua\http\index.html.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_bottom_left.png.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\MCESidebarCtrl.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Fortaleza.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\SaslPrepProfile_norm_bidi.spp.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-PT.pak.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\toc.gif.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-api.jar.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libnsc_plugin.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Windows Mail\ja-JP\msoeres.dll.mui.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.core_3.5.0.v20120725-1805.jar.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_ja.jar.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Syowa.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Uzhgorod.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpsychedelic_plugin.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Windows Journal\fr-FR\jnwmon.dll.mui.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\7-Zip\Lang\en.ttt.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\vlc.mo.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.properties.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui_5.5.0.165303.jar.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\vlc.mo.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_sun.png.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\HLS.api.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Goose_Bay.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_ja_4.4.0.v20140623020002.jar.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jre7\lib\zi\America\Mexico_City.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Windows Journal\Journal.exe.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SecStoreFile.ico.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Internet Explorer\en-US\iedvtool.dll.mui.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jre7\bin\sunec.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jre7\lib\jfr\profile.jfc.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Internet Explorer\networkinspection.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_ja.jar.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\librawvid_plugin.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\VideoLAN\VLC\plugins\plugins.dat.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libwingdi_plugin.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_zh_4.4.0.v20140623020002.jar.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vevay.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD56d12ea58107f79c191b8873a564f2247
SHA160decd0d8e185c3bcdcfe503c257a940cb23e1e7
SHA256a7ee5ecbf6ac086d7c49a4047a3cc7307ec6fb4f8773c35338c8f10d5cf9ef14
SHA512ef2f0db43d8f4a5ca9bda4e36fac6bc50afd50d91db3e81ea9ebac0ba9df9393f1a03986e202ec52407fc9c91ed3e9d03c9ef26475df36664ec6dc78031604e5
-
Filesize
56KB
MD57a3a1c882619d6dcc9fa7137de5d62c4
SHA1624b9c6914483f5d7470ad4318059f5ae1fbf2f3
SHA256e9b8c0180cb20a230556cfa5660cb227a2a1d38a65560ed7ec0c0769894da002
SHA512737ffc69a2b57e9a2d98335834a84f39908da8d593272890382ef3b6dadac9e8a8d3531f53c84b539d6fea3018fada38a1c9d7a0898b8e6cdf5a99862a09d529