6a20cb77e8cf5882bfc290cebb0735571ca69a92fff42b70a2a45d1a5b15f481

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 10:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8375e16e96e51544b9794c2413b14aa0N.exe
Size

96KB
MD5

8375e16e96e51544b9794c2413b14aa0
SHA1

d94a0d3a2e4178054e6ae97f60efd8a9257e705a
SHA256

6a20cb77e8cf5882bfc290cebb0735571ca69a92fff42b70a2a45d1a5b15f481
SHA512

e758452f72cd0e3376b97451d65d83808d05eba541bf9b7da837d4156f2a6c6d7cb58e41e57b33ae7ace5b4d74b4a7cc2183c21b009ec86797fdf06a692fc34d
SSDEEP

1536:W7ZhA7pApH1IwVHykEElEa0NQn0NQie+eq62yCUyCK:6e7WpnhkElEa0NQn0NQie+eo4K

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (2843) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightRegular.ttf.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Mozilla Firefox\softokn3.dll.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Common Files\System\DirectDB.dll.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-modules-appui.xml.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Krasnoyarsk.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dhaka.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7.png.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_ButtonGraphic.png.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_ja.jar.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-US.pak.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_zh_CN.jar.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kathmandu.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Internet Explorer\F12Resources.dll.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.properties.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-visual.xml.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationCore.resources.dll.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\management.dll.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Melbourne.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_ja.jar.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Design.Resources.dll.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InputPersonalization.exe.mui.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\javafx-doclet.jar.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.commands_5.5.0.165303.jar.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_ja_4.4.0.v20140623020002.jar.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_ja.jar.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\EST5EDT.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Mozilla Firefox\ipcclientcerts.dll.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576black.png.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\header-background.png.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Internet Explorer\MemoryAnalyzer.dll.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Davis.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.xml.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-core-kit.jar.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-ui.xml.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Paris.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\leftnav.gif.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_ja.jar.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Mozilla Firefox\fonts\TwemojiMozilla.ttf.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\smtp.jar.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper.registry_1.0.300.v20130327-1442.jar.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Mozilla Firefox\locale.ini.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kcms.dll.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-3.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Bucharest.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.identity_3.4.0.v20140827-1444.jar.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multiview.jar.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nassau.tmp	8375e16e96e51544b9794c2413b14aa0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.tmp	8375e16e96e51544b9794c2413b14aa0N.exe

C:\Users\Admin\AppData\Local\Temp\8375e16e96e51544b9794c2413b14aa0N.exe
"C:\Users\Admin\AppData\Local\Temp\8375e16e96e51544b9794c2413b14aa0N.exe"
1⤵
- Drops file in Program Files directory
PID:2172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini.tmp

Filesize
96KB

MD5
40014c78f319c6bed98a113a7dcda9e1

SHA1
ebe15721b31337d78deb3371346b55d1d472e804

SHA256
648cfd8c83c280fb73d2362bddeb4b28c68a3b6f81b46e858db1cf9454ddba40

SHA512
5c4b0c96d5ba87ef70d2146b2674cd0d3df0b2278cd6e90e01583e9e0c396faa9cb803aa1e37f48361d6f9870968a5a64b13b6b4c0d624ad7f4cbb6807657a9d

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
105KB

MD5
19e2eb215506db8dbb24402987487b09

SHA1
e0f5b8291a40864332e0580c918a0486588bca6a

SHA256
11f3080440b26fc2d44167437f39191d3b81175cedf3a6709a5b27733948aff5

SHA512
7b0b607b1f8cfd450a1f69cb89f09faacaf8705fbc243f120150dabf6f1e1203f850322e1f09a684a935a93ca7c5c225d4353f08488cbb969ca9a3b5da60dd61

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads