Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10-06-2024 23:14
Static task
static1
Behavioral task
behavioral1
Sample
6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe
Resource
win10v2004-20240426-en
General
-
Target
6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe
-
Size
44KB
-
MD5
33ce7d46c7d967719d76a8a55a674091
-
SHA1
4ac3a9165dd3ee7d70e749126b0d40e1a10153b0
-
SHA256
6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe
-
SHA512
2612afc78cacb3cdbdedaab23fdf758fbcb938838b9f03d44ef7145ecc1199f9f4d74c1d2c03d9da43e6261c730e21862da21a1c4a88dd372505169053f0874f
-
SSDEEP
384:GBt7Br5xjLMuLAgA71FbhvDl3DG71ul3DG71XUmUIYFt1zecDT1zecDB:W7BlpNLpARFbhblkYlkuvIYFWcDYcDB
Malware Config
Signatures
-
Renames multiple (4086) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop.wmv.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libwall_plugin.dll.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\7-Zip\Lang\nn.txt.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_ja.jar.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\libwin_msg_plugin.dll.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Java\jre7\bin\javacpl.exe.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libnfs_plugin.dll.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macTSFrame.png.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Windows Journal\NBMapTIP.dll.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-heapwalker.xml.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\7-Zip\Lang\kab.txt.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Kolkata.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\7-Zip\Lang\ja.txt.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_ButtonGraphic.png.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Windows Media Player\de-DE\setup_wm.exe.mui.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_bottom_right.png.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.lnk.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\picturePuzzle.css.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\27.png.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Ndjamena.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Windows Media Player\wmplayer.exe.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveDrop32x32.gif.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libdvdread_plugin.dll.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\currency.js.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_down.png.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\JOURNAL.INF.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jerusalem.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Gaza.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\MANIFEST.MF.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedQuanPin.txt.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationTypes.resources.dll.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\settings.css.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\THMBNAIL.PNG.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\3.png.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-11.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\settings.js.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Internet Explorer\ielowutil.exe.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double_orange.png.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.ja_5.5.0.165303.jar.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\Rio_Gallegos.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Common Files\System\ado\msado26.tlb.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.ja_5.5.0.165303.jar.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-uisupport.xml.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Sakhalin.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\vlc.mo.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile_drop_shadow.png.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClient.dll.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\about.html.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-outline.xml.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Selectors.Resources.dll.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe File created C:\Program Files\Java\jre7\lib\zi\Atlantic\Cape_Verde.tmp 6e47d141bff0211d7c9568866e9a17ef281e4c3c2897dc60841a83baf4640dfe.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD591c3838105dad8d667847f91a56e7cef
SHA137c688fdf0d8a7a913cba0433c2df43c10c2c5d7
SHA2568cc4d2b45aeb298d1273a639e1bf77dd38c585c4111299888c42c9df28c2d93f
SHA51261a99535bd9eb9e25f942fc0558eae544c3b8f0c1d5bf104cc97819fcb9eb7903000811766e00a3b236e2c24719033eee7920e8b6b731c66da7af22ce4e9933b
-
Filesize
53KB
MD5c8ace47a9f521e8502d8fb698512dab2
SHA1b285f4a5155d17ba03b60184a371731c2d2654f0
SHA256cac0a1c4682ffcfa69ee3944476c1f47a1ac8c519810b48f442a50b12eefe448
SHA512c573b6f4fbcd098665476deb373166d64bfd3dd7dc10999460eb0811d3e7a89a44463257615670f230dc5c51fdb7360757fe75c914b7cf97d7c1924bab7fc984