Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11-06-2024 01:28
Behavioral task
behavioral1
Sample
a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe
Resource
win10v2004-20240426-en
General
-
Target
a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe
-
Size
98KB
-
MD5
cd9f2391e7770809e85392db6c3645f0
-
SHA1
b400e04c6d056a46faeac733cec58f96f5dbfaff
-
SHA256
a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a
-
SHA512
f4a8445cdacbac04143ef8081d5337fc73de3a53a276dcb705b8b431c856a7c69026c4bcf28beb2243df085a8298cc8dfd11aefdffa97c089a6621583bb7248d
-
SSDEEP
1536:a7ZyqaFAlsr1++PJHJXFAIuZAIuyxX5rQul8:enaym3AIuZAIuyxJrQul8
Malware Config
Signatures
-
Renames multiple (3481) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral1/memory/2084-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral1/files/0x000c0000000122eb-2.dat UPX behavioral1/files/0x00020000000106a2-6.dat UPX behavioral1/memory/2084-646-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
resource yara_rule behavioral1/memory/2084-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000c0000000122eb-2.dat upx behavioral1/files/0x00020000000106a2-6.dat upx behavioral1/memory/2084-646-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_ja.jar.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-cli.jar.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jre7\lib\zi\America\Paramaribo.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_h.png.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nb.pak.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\chkrzm.exe.mui.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libdrawable_plugin.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Windows NT\Accessories\de-DE\wordpad.exe.mui.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\library.js.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\selection_subpicture.png.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Johannesburg.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.Selectors.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\7.png.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guam.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_ja.jar.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libbluray-awt-j2se-1.3.2.jar.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libskiptags_plugin.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_over.png.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\travel.png.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.lock.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.attributeTransformation.exsd.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lindeman.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\jawt.lib.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodbig.gif.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_ja.jar.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Riga.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Microsoft Office\Office14\Custom.propdesc.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Windows Media Player\it-IT\wmpnssui.dll.mui.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santiago.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security_1.2.0.v20130424-1801.jar.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Windows NT\TableTextService\de-DE\TableTextService.dll.mui.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Menominee.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Norfolk.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.ssl_1.0.0.v20140827-1444.jar.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jre7\bin\splashscreen.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jre7\lib\zi\Atlantic\Bermuda.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_hail.png.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\es-ES\MSTTSLoc.dll.mui.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt_3.103.1.v20140903-1938.jar.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yakutsk.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Marquesas.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Seoul.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPOlive.png.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_zh_CN.jar.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Mozilla Firefox\lgpllibs.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\7-Zip\Lang\th.txt.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\imjplm.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.RunTime.Serialization.Resources.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\currency.js.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_up.png.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-awt_ja.jar.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-ui.jar.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedZhengMa.txt.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jre7\lib\zi\America\El_Salvador.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98KB
MD5b0fc827c7da45df37a400ccf8f40029c
SHA1a08555fd5e8d968d37c13af179798079c66a7bb1
SHA256e86f39e108d4a76ee7705011c0da07ef2c4ac48b6a78ac08c5d42190a2002652
SHA51209845f9e87d3783087f48ea8efdace3d658069624977d98d0b155c0ec40e33f9cba522790954e107f804163a4df2ef44fec6b89cdc7f72574933e998ff2a3173
-
Filesize
107KB
MD545f116b4b8bb270e021db8dc024cc118
SHA15fd21e096895bd543fc6122227192b2d2f679b68
SHA256dcf2aa87af6c749f3673f56384889dafaba2d363665cd90a4edf7547dda39e68
SHA512030fd260e60e97bf1a5440bca33218700bbba0a6be6dd4a052a44a64d5aedd5de96c2b6da7413a357675821e7999f86de44d6b13c40e009cad9fbf8e9465242b