Analysis
- max time kernel
150s - max time network
118s - platform
windows7_x64 - resource
win7-20240419-en - resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system - submitted
11/06/2024, 21:49
Behavioral task
behavioral1
Sample
4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe
Resource
win7-20240419-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe
- Size 82KB
- Sample240611-1pe27atake
- SHA256 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19
- MD5 1e629e30f5fe453e1204ee35f577143e
- SHA1 47e60b50808e7e533b5f66b45cec46ba2aee5eb5
- SHA512 0f30fde0bc5c8647b5375d46889089251b1675966b029b071236c1b0eaababf34e1df9e107ac001363ca7dbfd5ed7c69b128f6097451ba64194199339b62b544
- SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsTq5q9BVI2IWcK:fnyiQSohsUsWU9BK3WcK
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (3534) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral1/memory/2188-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral1/files/0x000d00000001228a-2.dat UPX behavioral1/files/0x000200000001048e-6.dat UPX behavioral1/memory/2188-654-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
resource yara_rule behavioral1/memory/2188-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000d00000001228a-2.dat upx behavioral1/files/0x000200000001048e-6.dat upx behavioral1/memory/2188-654-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Knox.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-execution.xml_hidden.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Tunis.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Istanbul.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Windows Defender\it-IT\MpAsDesc.dll.mui.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\Vdk10.rst.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_ja.jar.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Casey.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Hong_Kong.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Windows Media Player\de-DE\wmpnetwk.exe.mui.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Windows Media Player\de-DE\WMPSideShowGadget.exe.mui.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Maputo.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-attach.xml.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.xml.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.properties.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.xml.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_ja.jar.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiling.xml.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\Mendoza.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\DVD Maker\Shared\Common.fxh.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ja.pak.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerConstraints.exsd.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Windows Mail\wab.exe.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile_drop_shadow.png.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Boise.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser_5.5.0.165303.jar.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.RunTime.Serialization.Resources.dll.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_partly-cloudy.png.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\7-Zip\Lang\ka.txt.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_zh_CN.jar.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jre7\bin\jawt.dll.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jre7\lib\zi\America\Vancouver.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.resources.dll.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libpodcast_plugin.dll.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Windows Media Player\ja-JP\wmpnetwk.exe.mui.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui_5.5.0.165303.jar.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.shell_0.10.0.v201212101605.jar.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-api.xml.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_zh_CN.jar.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jre7\lib\javafx.properties.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationProvider.resources.dll.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Tell_City.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Easter.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_ja.jar.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Mozilla Firefox\locale.ini.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nl.pak.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\MST7MDT.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Microsoft Games\Purble Place\it-IT\PurblePlace.exe.mui.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\VideoLAN\VLC\libvlccore.dll.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Windows Media Player\de-DE\wmplayer.exe.mui.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\blacklist.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Makassar.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di_1.0.0.v20140328-2112.jar.tmp 4eda0af1a3f856db8221b384c20789ba84aba8cf329f5ee621b42cde5f169e19.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp
- Size 82KB
- SHA256 d695c19e32d088b60b3d8388e12ff442629268ffe16379007d39d22094d38ea8
- MD5 9d75478c45bcb99a32c92e17ddd3ce21
- SHA1 0561ad4bf9d5749fe024e2c51255473a362a9c61
- SHA512 6fdbae8e186a546540545e9bce535182e5212117b087c40a25c48f3339a8483c6dafb6892ab61ed76f2c65a54bb2cda130154b3a9a7b3727a20726a444921c88
- SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsTq5q9BVI2IWcB:fnyiQSohsUsWU9BK3WcB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
- Size 91KB
- SHA256 da5deb3b6abff468e064da4995e8b1ca8b3986ffc10b89334afb95d3792f04f3
- MD5 2c1a005bdbf0330aba716962deb9d0fd
- SHA1 d3bff655da11840a23ddbfae3cbd432244288472
- SHA512 7c7ca26d47aac2757ec750765d30fe640599cc99c82910fb02c65be2d204d4acd735548c09b8d84d85aa6c761e03a538e4618c6ceedf5246fff768793c3ecfd1
- SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsTq5q9BVI2IWcP:fnyiQSohsUsWU9BK3WcP
- MD5 SHA1 SHA512 SSDEEP