8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 23:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
Size

47KB
MD5

efbd984c68694c4a223c21f0908b9180
SHA1

4ac9f6e8ccecf99b18839d5ba496b53f87efaba1
SHA256

8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457
SHA512

a00044d248f9180d66ddac8b0664a8f1d6c709a86512bdc6dca47ba4154cd6ccc504d8d9e99895875d31fe94663c20f71147f6b7bba47f128e717ad8b703da2d
SSDEEP

768:W7BlpppARFbhFAVo7FOtiJw1OtiJfo7FOtiJw1OtiJtjM2jMRTB:W7ZppAp1IWINI2Ir

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3433) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libvorbis_plugin.dll.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libh26x_plugin.dll.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Ojinaga.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rainy_River.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Honolulu.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Paramaribo.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\micaut.dll.mui.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Java\jre7\bin\jabswitch.exe.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_ButtonGraphic.png.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Microsoft Games\FreeCell\it-IT\FreeCell.exe.mui.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Windows Journal\Templates\Memo.jtp.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\ChkrRes.dll.mui.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-runtime-l1-1-0.dll.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.xml.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\MSTTSLoc.dll.mui.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcfr.dll.mui.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Boa_Vista.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmirror_plugin.dll.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_zh_4.4.0.v20140623020002.jar.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macHandle.png.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.clusters.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Java\jre7\lib\security\cacerts.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Java\jre7\lib\jfr\profile.jfc.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Monaco.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-api.xml.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\vlc.mo.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedShuangPin.txt.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Curacao.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Luxembourg.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Wake.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_cs.jar.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\RELEASE-NOTES.html.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-modules_zh_CN.jar.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Windows Media Player\it-IT\setup_wm.exe.mui.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\7-Zip\Lang\be.txt.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfxrt.jar.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-applemenu.xml.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpnr.dll.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\shvlzm.exe.mui.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Windows Media Player\es-ES\wmpnetwk.exe.mui.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaom_plugin.dll.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\cpu.html.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-cli.jar.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvmstat.xml.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cambridge_Bay.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_wasapi_plugin.dll.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libparam_eq_plugin.dll.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\back.png.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_ja.jar.tmp	8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe

C:\Users\Admin\AppData\Local\Temp\8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe
"C:\Users\Admin\AppData\Local\Temp\8869e27212b9e285c97b406254cd876e626ed602f73f38d2e414749dae34e457.exe"
1⤵
- Drops file in Program Files directory
PID:2084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.tmp

Filesize
48KB

MD5
ecc5ea4dea4f9c9a0e002ae2d248f5d0

SHA1
18690ec7561d7c5dbc2fd57577a135e49ca66f5f

SHA256
601d28c2a7e86a5720330b787581e46ef2b587900586cfd8c66cf6d5bfd4b1cf

SHA512
0b0203d7465f4f34064a52a72646653db8507d8363ea665e4bbfaece09927cf0afae868c36d915f2dd8da3805a9039d335cce7b0addf6b1f7ab2618828c709a2

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
57KB

MD5
9693cf9d3a7bc102d5143e9158134d32

SHA1
0d3ef80daeaf17f58b55842bbee1926c22472b07

SHA256
79cc7083a0e546181eac749bdba5e4cdab5c7e3235cca7eb51ed7ed854e80ba0

SHA512
d85a6a49dca7124d0d089e5e208bfd6754ce28495b8d630f5adda4be434ac3f8a061cac214a8ca3dd63444a5a87541a4976df3d7ca945053a47c11e8ccf46838

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads