Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 22:57
Behavioral task
behavioral1
Sample
6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
Resource
win10v2004-20240508-en
General
-
Target
6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
-
Size
195KB
-
MD5
3c39e034ff26d403cdfccacea38acbf5
-
SHA1
f45d2de958018c07688871efcc14ac37d25ebd46
-
SHA256
6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735
-
SHA512
56dcd478f0e85ea78e3e5c0d04738866e1211c228692192c6abafea3f079ea8da6059b097c8f6f3608ebe0a990a917f5e381d0c9b1c422722a29b5b598a86ef3
-
SSDEEP
1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCo:+nymCAIuZAIuYSMjoqtMHfhf4Y
Malware Config
Signatures
-
Renames multiple (3231) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
UPX dump on OEP (original entry point) 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2968-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmp UPX C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp UPX behavioral1/memory/2968-598-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
Processes:
resource yara_rule behavioral1/memory/2968-0-0x0000000000400000-0x000000000040B000-memory.dmp upx C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmp upx C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp upx behavioral1/memory/2968-598-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exedescription ioc process File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Linq.Resources.dll.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\msinfo32.exe.mui.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator_2.0.0.v20131217-1203.jar.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_zh_CN.jar.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\day-of-week-16.png.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-9.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Paris.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.access.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7.png.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\SpiderSolitaire.exe.mui.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libavcodec_plugin.dll.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Entity.Design.Resources.dll.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Mozilla Firefox\firefox.exe.sig.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\libhotkeys_plugin.dll.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jre7\bin\jabswitch.exe.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Microsoft Games\Chess\de-DE\Chess.exe.mui.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_ja.jar.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Common Files\System\wab32res.dll.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_ja.jar.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\VideoLAN\VLC\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup-impl.jar.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jre7\lib\zi\America\Los_Angeles.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\classlist.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Anadyr.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Lindeman.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Windows.Presentation.resources.dll.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\vlc.mo.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di.extensions_0.12.0.v20140417-2033.jar.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jre7\lib\logging.properties.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Kuala_Lumpur.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_CN.properties.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IdentityModel.Resources.dll.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-core-kit.xml_hidden.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\ant-javafx.jar.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-visual.xml.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libudp_plugin.dll.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands_0.10.2.v20140424-2344.jar.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Resources.dll.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_ButtonGraphic.png.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\MANIFEST.MF.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Microsoft Games\FreeCell\ja-JP\FreeCell.exe.mui.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property_1.4.200.v20140214-0004.jar.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_zh_4.4.0.v20140623020002.jar.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jre7\lib\security\US_export_policy.jar.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.zh_CN_5.5.0.165303.jar.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Speech.resources.dll.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_ja_4.4.0.v20140623020002.jar.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Microsoft Games\Purble Place\it-IT\PurblePlace.exe.mui.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Tirane.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\VideoLAN\VLC\libvlc.dll.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe File created C:\Program Files\Microsoft Games\More Games\ja-JP\MoreGames.dll.mui.tmp 6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmpFilesize
195KB
MD5ebcf1c9c4978f99d98d3b1e725f9d0c6
SHA1c8288309f870e971fd9da257d6b0df7575c25a9b
SHA25630b3cfa61809c3ab932c64c40f449c80915e2af9b611227bc15cb29cd8339a69
SHA5129a9f528d74c6ae6401cc4a5ad5bd4a7ac3d949cb695115d5bcb00f3d3bf0065992500e05543bf403160ffafe1520f0082f1e37e259cdb892950bc397a3050e44
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmpFilesize
204KB
MD56e80fb801de71bff283c896676906100
SHA18d6464370a7f5a9c28d61549b3e8f2b6e7570a9b
SHA25616b76e1c350ca6359aef3f85152d7fe56dface04cb6d6dcf5979ee8b421cee3e
SHA512661e41636a54bd4adbc0687e33fab0090dc329d0ea560c0ef63b3778777179aed8ab1dc5f0b64f01c9554a5b2dfa22ed2873447416e0647e0202d7abe3d446d9
-
memory/2968-0-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2968-598-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB