c5355c08ae1b584248f602c8797d87f7f52ff701e6a3c18b9d4e2caa1b38202f

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 12:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c49d48a2db08ce9d693818d285f803f0N.exe
Size

95KB
MD5

c49d48a2db08ce9d693818d285f803f0
SHA1

f3f5030f5f01718dce294a91a74d69584914cdf0
SHA256

c5355c08ae1b584248f602c8797d87f7f52ff701e6a3c18b9d4e2caa1b38202f
SHA512

1b568b98b72c8f13ff4d463b973ad06a931e33dab9daab5fe4f6fae873d1bf3c3babb04e370ad6ed91fc83b3a7868258969498f9d97b4bcc955dbeafdedfc99a
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E6DGsTdc6e6kvNDck7Tdc6e6kvNDckkvVv/UxYnnZ/:69WpQEoTdc6e6kvNDck7Tdc6e6kvNDcp

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (2595) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\day-of-week-16.png.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_zh_TW.properties.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.c.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-loaders.xml.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\ConnectGet.emf.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bishkek.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-US.pak.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator_2.0.0.v20131217-1203.jar.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-text.jar.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guyana.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Uzhgorod.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\bandwidth.png.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_SelectionSubpicture.png.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vulkan-1.dll.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_zh_CN.jar.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Santarem.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Volgograd.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.ja_5.5.0.165303.jar.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\MANIFEST.MF.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_ja.jar.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_zh_CN.jar.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Resolute.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.properties.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JdbcOdbc.dll.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\La_Paz.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sampler.xml.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-text.xml.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-api-caching.xml.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application.xml.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jre7\lib\ext\jaccess.jar.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack.dll.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_zh_HK.properties.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\MANIFEST.MF.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wake.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.command_0.10.0.v201209301215.jar.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark.css.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multitabs.jar.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-compat.xml.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_ja.jar.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Iqaluit.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Matamoros.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qyzylorda.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\README.txt.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-templates.xml_hidden.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Common Files\System\msadc\handler.reg.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kuala_Lumpur.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Los_Angeles.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.zh_CN_5.5.0.165303.jar.tmp	c49d48a2db08ce9d693818d285f803f0N.exe

C:\Users\Admin\AppData\Local\Temp\c49d48a2db08ce9d693818d285f803f0N.exe
"C:\Users\Admin\AppData\Local\Temp\c49d48a2db08ce9d693818d285f803f0N.exe"
1⤵
- Drops file in Program Files directory
PID:828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp

Filesize
96KB

MD5
b8f1930ae2400a253fa49f972a1ad043

SHA1
5bc4f93131b4d6c1b82bc146bac147aff27e616b

SHA256
21e94282c473022e7b2e05243a2d92f3f1bfa733eed62933098802b5f42be30e

SHA512
db482944a9ff8adaf57a4349feadded0c8c798c8c0db03cf7533c73ef035b25bbe3b511a8139db6ebe6e936fc05d5385e8d832e3c888ef6e2134270045372f92

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
104KB

MD5
9123842c7c457264e05d54db2ff9de48

SHA1
7e5eb6ecda6e09c0b58e6bc76ca56316a029dc93

SHA256
6d9b3fd20bd7c9cc09710f1453f222e92b241b4d9f565f7891bd2e87eed4ba91

SHA512
fee7391f7b3d49c9ef0930184babfa0fb2ee5f918271985151a735664727ff31831bea963cfc37d11b7947ca6350508d0588cb287b92103b16b0464fda38d03a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads