Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 23:06
Behavioral task
behavioral1
Sample
6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
Resource
win10v2004-20240508-en
General
-
Target
6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
-
Size
63KB
-
MD5
851af2515c3ad972639f5dbab50a410f
-
SHA1
e2d24a6f0536b8f70a89f41f0f6a080bdea1053f
-
SHA256
6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357
-
SHA512
56a6f5a0ba4d10be143f869c28ff0bf41fc12371f1c8a955c79936e90f4d9ba8cd8fc8feaef3a62c492d6f10a3113ec91f9c8beaebc86301ee2468a31d18a0d8
-
SSDEEP
1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8E:+nyiQSob
Malware Config
Signatures
-
Renames multiple (1027) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
UPX dump on OEP (original entry point) 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1692-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmp UPX C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp UPX behavioral1/memory/1692-68-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
Processes:
resource yara_rule behavioral1/memory/1692-0-0x0000000000400000-0x000000000040B000-memory.dmp upx C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmp upx C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp upx behavioral1/memory/1692-68-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exedescription ioc process File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\de.pak.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_hu.jar.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Bougainville.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\7-Zip\Lang\tg.txt.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Internet Explorer\ielowutil.exe.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Internet Explorer\JSProfilerCore.dll.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santo_Domingo.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoCanary.png.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\kcms.dll.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\US_export_policy.jar.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Warsaw.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\7-Zip\Lang\eu.txt.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxml2.dll.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Damascus.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\7-Zip\Lang\hr.txt.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\desktop.ini.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Paramaribo.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mauritius.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InputPersonalization.exe.mui.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Anadyr.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ru.jar.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Salta.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Louisville.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\7-Zip\Lang\an.txt.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\micaut.dll.mui.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\New_York.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\7-Zip\Lang\mr.txt.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mip.exe.mui.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\logging.properties.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Khandyga.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyclient.jar.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Rangoon.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\DVD Maker\OmdProject.dll.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Internet Explorer\DiagnosticsHub.DataWarehouse.dll.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Internet Explorer\F12.dll.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\1047x576black.png.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Internet Explorer\ieproxy.dll.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ja.properties.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png.tmp 6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmpFilesize
63KB
MD5c23aa024d91eae55dd7811413d329eca
SHA1248d4cbfb18e1a63681af8679e7ce48645c844e0
SHA256e5637cffb3dcefb4e919abcf3b7328296f5d262e08242553c4bc1a34797fd1c2
SHA512316be80dcd68fc901092a8f57dd5af9bc6f8931127cebcce3c40c7db694ac09d811bc084f121daa035e83a647affa9f4d4c217b597b7eef3b9fa439c3bfb14c7
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmpFilesize
72KB
MD59d2eeab8d022685182a700f59f52336c
SHA1c573bfb6cea015540b10b385275563624d1cdf17
SHA256b4f7f6a53aa46dd0c9595f20a2210f0e09964e80dbdb6d2f89e833d85ffc7898
SHA512a79cb1c4c9f39b31bad80031532b9fda1bb7eeca1607ccb0404c3739b1effc47dc2ff409a0d61f14ba9724c8290d771d8e043c1b1bb82de536923d273f4164ba
-
memory/1692-0-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1692-68-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB