3809a03b008b63eddb55f5311e238bf024d42d0993b35e5c6995cca381a2224d

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 22:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0de4642b4bca1d8d86049021d4c752d0N.exe
Size

90KB
MD5

0de4642b4bca1d8d86049021d4c752d0
SHA1

1b6a97497a095c62208516c6ba1e529dd72e0713
SHA256

3809a03b008b63eddb55f5311e238bf024d42d0993b35e5c6995cca381a2224d
SHA512

3d362e2b507a03c47774c03a7882dc8ecf578a1bb84cb1557a178cb8389937e4bf90849c38737870d228a9b8ac14a45d36e294ae5c98893b1f52b882ccfcaf15
SSDEEP

1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPNlBSm:6rWpcOPxPke+e3fFpsJOfFpsJbgEbN

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3250) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\vlc.mo.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libedummy_plugin.dll.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyrun.jar.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tahiti.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Tashkent.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Engine.resources.dll.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Windows.Presentation.resources.dll.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationProvider.resources.dll.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bishkek.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\es-ES\Minesweeper.exe.mui.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\vlc.mo.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveAnother.png.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libwin_msg_plugin.dll.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-api.jar.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Tbilisi.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Yekaterinburg.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Subpicture1.png.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG.wmv.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Cape_Verde.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\VERSION.txt.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedback.gif.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.io_8.1.14.v20131031.jar.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Macau.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app_1.0.300.v20140228-1829.jar.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\sd\jamendo.luac.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_pt_BR.properties.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macHandle.png.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\Chkr.dll.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\liveleak.luac.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guyana.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\jawt.lib.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_ja.jar.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\it-IT\Minesweeper.exe.mui.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Internet Explorer\MemoryAnalyzer.dll.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\VideoLAN\VLC\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Common Files\System\DirectDB.dll.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7TSFrame.png.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Internet Explorer\Timeline_is.dll.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\vlc.mo.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libtimecode_plugin.dll.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_dummy_plugin.dll.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\liblibass_plugin.dll.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodbig.gif.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hovd.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Krasnoyarsk.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\DVD Maker\es-ES\DVDMaker.exe.mui.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPHandle.png.tmp	0de4642b4bca1d8d86049021d4c752d0N.exe

C:\Users\Admin\AppData\Local\Temp\0de4642b4bca1d8d86049021d4c752d0N.exe
"C:\Users\Admin\AppData\Local\Temp\0de4642b4bca1d8d86049021d4c752d0N.exe"
1⤵
- Drops file in Program Files directory
PID:2804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2660163958-4080398480-1122754539-1000\desktop.ini.tmp

Filesize
90KB

MD5
ee016fe02da2bfc5ada8937c637e74b2

SHA1
c2ffd4e9310e566c187fde118a55c6e170b4eff5

SHA256
6c154da73f936c8bd1166743b8ac98789731086b15558095eec88fa24a5f43fd

SHA512
6e6dd87447101f991ad7f7de855289a2d1dc9b34a93992c3792edeb80a59286d80e5a01326116596df53cbba8af5c80862f0b39dd9118f3bee9a073ced0e6ab4

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
99KB

MD5
2468cf0f659bbc52a9708c6201d8e757

SHA1
9cf110503b6f2abb8c1fa400cfae870c85642ab0

SHA256
a3a2d0dbc69018317b8baa2f903a6a0608ade8bae1fe88ed9909664db4f8b44e

SHA512
24ed495981edf52c7d2054f37a5dd02cfe1115a1f6837c3dc5dd53924e1b3df500f8457041264f04b40278e3de16a8d45abb3abe8b0fc0815f0c798dd9016c60

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads