8d8f074e9f072fd4a778695f6be3798d89d585d4ff5fe2e34e1a324651bebe0d

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 08:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3371cddf4e72ff2f6389a46850c47410N.exe
Size

31KB
MD5

3371cddf4e72ff2f6389a46850c47410
SHA1

6983baacc8adf602d6b48adfd86b4ccf6a71f006
SHA256

8d8f074e9f072fd4a778695f6be3798d89d585d4ff5fe2e34e1a324651bebe0d
SHA512

1c827cdc2bfd341da800945819b3cdca9680e7da14fad3198d1adb0a1021de5cab7b02d75fceacbc406610b771dd4d0bf913dafccaf0e712861a8861df7910c9
SSDEEP

192:tACUADIY0Br5xjL/FAgAQmP1oynLb22vuN6GnN6GOVv:GBt7Br5xjL9AgA71FbhvuNBNwVv

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3456) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\bin\jawt.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmjpeg_plugin.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_zh_4.4.0.v20140623020002.jar.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libcvdsub_plugin.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-iio.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-9.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_ja.jar.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\.lastModified.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Microsoft Games\More Games\fr-FR\MoreGames.dll.mui.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\SkipBackup.bin.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di_1.0.0.v20140328-2112.jar.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\sa-jdi.jar.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_zh_CN.jar.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Mozilla Firefox\mozglue.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs.xml.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_zh_CN.jar.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jre7\lib\jsse.jar.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationFramework.resources.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Windows Mail\wabmig.exe.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libgestures_plugin.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\leftnav.gif.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticattribute.exsd.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet.jsp_2.2.0.v201112011158.jar.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\7-Zip\Lang\pt.txt.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\LICENSE.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\CST6.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_ja_4.4.0.v20140623020002.jar.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\fr-FR\Solitaire.exe.mui.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Mozilla Firefox\libEGL.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kab\LC_MESSAGES\vlc.mo.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Windows Media Player\Media Renderer\RenderingControl.xml.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui_5.5.0.165303.jar.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Windows Journal\it-IT\MSPVWCTL.DLL.mui.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Windows Media Player\en-US\setup_wm.exe.mui.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sw.pak.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Macau.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sampler.xml.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-plaf.xml.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_ja_4.4.0.v20140623020002.jar.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_ja_4.4.0.v20140623020002.jar.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macGrey.png.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-annotations-common.jar.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-fallback.jar.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationBuildTasks.resources.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\newgrounds.luac.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui.tmp	3371cddf4e72ff2f6389a46850c47410N.exe

C:\Users\Admin\AppData\Local\Temp\3371cddf4e72ff2f6389a46850c47410N.exe
"C:\Users\Admin\AppData\Local\Temp\3371cddf4e72ff2f6389a46850c47410N.exe"
1⤵
- Drops file in Program Files directory
PID:2544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini.tmp

Filesize
31KB

MD5
615ef3807e362eda5c2882be0784f27f

SHA1
ebf247a7e0517725c8a4cb72fe9623bfc2b6b60f

SHA256
b4b8e022b7d56390ced164302cb812735f4d4d72e08fad73b2ab03e385816ccd

SHA512
4d43b94066b72c0a8289beefc387fc36c094aedad5d4cda8088183a0d95a288441db0f97200b65f3778baa315a2dc854dda5a8dbf0bf32b37a3a0c77c802694d

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
40KB

MD5
f22418856c69a4bd54efd1d3c9b3cd6d

SHA1
e83c3b994642f5d02689de832c363b9b45a0d703

SHA256
935400f9275e1477bc8ed5947c3238253514615f10741d4af981fc5e93cc21af

SHA512
ac2980b61dd8d53ec639ee667e62c3c365e49fe4c9e308f9f4901d01fe28e5bcddad2e94e0dce298de7b6bb957930c577676dd64f8b984c64c7784a7207d8388

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads