f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 04:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
Size

88KB
MD5

f24e0fd29a2192e4fa9bfbddadf826f9
SHA1

6d0f9fedb904c3f9594d363dd3c3d5e999489077
SHA256

f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189
SHA512

a43397561935e3c405864fcde02259687bced946b4f807be8e266c15c6b7c02989ecc7e6da68ff1dc9f65ff2b246f39f61a22a937a87e3cb828beb914c6b1109
SSDEEP

1536:W7ZhA7pApvOsOKjC0YSilpFpfkJOMMJIJxjFLxI:6e7WpXYvntJixjFG

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3544) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IO.Log.Resources.dll.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Windows Media Player\it-IT\WMPDMCCore.dll.mui.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winClassicTSFrame.png.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-spi-actions.xml.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Ust-Nera.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_ja_4.4.0.v20140623020002.jar.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\vlc.mo.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\logo.png.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_pressed.png.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-13.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\clock.html.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial.png.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Kosrae.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmpgv_plugin.dll.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\cpu.js.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\es-ES\MSTTSLoc.dll.mui.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_cycle_plugin.dll.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\settings.html.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libupnp_plugin.dll.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgrain_plugin.dll.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\VideoLAN\VLC\skins\fonts\FreeSansBold.ttf.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bogota.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\vlc.mo.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\librawvideo_plugin.dll.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Net.Resources.dll.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\settings.js.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Windhoek.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_zh_4.4.0.v20140623020002.jar.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-attach.xml.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host.xml.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jvm.hprof.txt.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nome.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Copenhagen.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Beulah.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libflaschen_plugin.dll.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\back.png.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-cli.xml.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libimem_plugin.dll.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libxml_plugin.dll.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Barbados.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Thule.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_ja_4.4.0.v20140623020002.jar.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia_Banderas.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Marquesas.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_ja.jar.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\vlc.mo.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Windows Media Player\es-ES\wmpnscfg.exe.mui.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\logo.png.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Mozilla Firefox\precomplete.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\vlc.mo.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libt140_plugin.dll.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application_5.5.0.165303.jar.tmp	f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe

C:\Users\Admin\AppData\Local\Temp\f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe
"C:\Users\Admin\AppData\Local\Temp\f9663bfa691218318eb4b9146813f36c435bc537c1bb7a51974475052764b189.exe"
1⤵
- Drops file in Program Files directory
PID:956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmp

Filesize
89KB

MD5
88ec891d6b310b8fc98edbbf1303e3c3

SHA1
d0417220ee58b176fe3455f061dd137305e25bda

SHA256
ae1f7ef33c12e3bfe26c81f20bdbeea86e51d8fbcea68f71ba67bdf202dc5bc8

SHA512
01bd803909fede69227cbb13080da853e2345b5d461bba656ae9b3aaf9e94a39e5f0cd2e645cf172d6f9cd0a36b3f3f3c72bd0e2b3f60718d66a7a17aa5d80c8

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
98KB

MD5
7788126ee90b5609e1b802afb7e451f2

SHA1
91a15fc1a4016fc2b38f266ad648aa349b557bc3

SHA256
92f2938a5299754368e788f729be0eba73e3beaa1930376ba762f2ec3ae57a76

SHA512
41a85664d4b69c92c9b7c3fd41eeb32517db376405feec3584f812769ab5e4b8da83b28aa243174a316284036a2d8b61a31cb97903004c5073a09e8686a963fe

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads