2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 19:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
Size

50KB
MD5

542b0ec9452953e168a8242f31ecdfa6
SHA1

dc182179efc28c7cc5319e6890e0c47703acefbb
SHA256

2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45
SHA512

49870a24e9038517641e5e873cad003dac17cffe975d452be3370c2ed559da708c2ae812eb1e5722598a69ee548ce3ad67c7c1e2ce1bbdf8edbbe18e0145a1a1
SSDEEP

768:W7BlpNLpARFbhblkYlkuvIYFPdAJxRdAJxBF/MF/2:W7ZNLpApCZuvIYr2+

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3739) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\activity16v.png.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\hxdsui.dll.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_zh_CN.jar.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Windows Journal\es-ES\Journal.exe.mui.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\gadget.xml.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)grayStateIcon.png.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.jdp_5.5.0.165303.jar.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_lrg_sml.png.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdca_plugin.dll.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\add_reviewer.gif.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\DVD Maker\ja-JP\DVDMaker.exe.mui.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_ja.jar.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_ja.jar.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Madrid.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\PST8.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Microsoft Office\Office14\MSOHEVI.DLL.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\vlc.mo.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JAWTAccessBridge-64.dll.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ja.properties.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santo_Domingo.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\micaut.dll.mui.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Microsoft Games\More Games\en-US\MoreGames.dll.mui.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\NPSWF32.dll.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Samara.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.ja_5.5.0.165303.jar.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\notification_plugin.jar.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-api-visual.xml_hidden.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-util-enumerations.xml_hidden.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+9.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Common Files\System\msadc\msadcs.dll.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.RSA.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_it.properties.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_zh_4.4.0.v20140623020002.jar.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_ja.jar.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_zh_CN.jar.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.metadata.repository.prefs.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\gadget.xml.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\RSSFeeds.js.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-first-quarter.png.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\clock.css.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\library.js.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_pressed.png.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Microsoft Office\Office14\OLKFSTUB.DLL.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\VideoLAN\VLC\npvlc.dll.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-execution.xml.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClient.dll.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssBackBlue_Undocked.png.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_it.jar.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.util_1.0.500.v20130404-1337.jar.tmp	2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe

C:\Users\Admin\AppData\Local\Temp\2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe
"C:\Users\Admin\AppData\Local\Temp\2a90ac5b20d4eff1cd3f59d82e8a16bf58cc16756396aca5b4675353b7257b45.exe"
1⤵
- Drops file in Program Files directory
PID:2380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.tmp

Filesize
50KB

MD5
b4fac6a4c141596c6be688c627095ffb

SHA1
11e87343f7aefc1480051289c1bf949debf1e2bd

SHA256
a505778351e32f5abde50955ccb7b95b6cc6a406afaac89cab3f95bdbcf4be83

SHA512
5ee4bc8732ebc2d98f4a5f36c73b70e6ad8dbca14b9ccfbaeb56917e34e49c69565f3ccc67bb5a8ffb23b55b56987bc2f9da460b3e183b16cfe9fd6ccfc73114

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
59KB

MD5
68c1f3dba9085b328920c88e02a4a46f

SHA1
1087729bcfafba1999a53d7fd78ede82946967c7

SHA256
fad32837a18a6d0d1d8a58de279946965723ac0f20be98b117b781fe0dc6ccdb

SHA512
7a646a58a246ec508b7c064ff04fc7d9bdd67cdca086188428149ff9186218e2446ac260c3bdf916d844523f21238ab20920b3de3a2fa234cb6f42f05e942cc8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads