Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 22:39
Static task
static1
Behavioral task
behavioral1
Sample
6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
Resource
win10v2004-20240709-en
General
-
Target
6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
-
Size
72KB
-
MD5
9d183c314f13d9f9891e9dd3a8d5b752
-
SHA1
6e8b88a09ebbece0bba4c69e8cfd4b1ca23f7f18
-
SHA256
6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827
-
SHA512
2e9ef509535ea22ed5f9d0c18f3c8420f55646eb6d8cc79e271a6206f6cfc2e089cad6076919c31f6420f8803de28d83c4389ce90d1ceece41d2d1534d4a682a
-
SSDEEP
1536:W7Z+pApfGQ3y3RWvfmRfm9sKsSd5GT6Sr:6+WpDfmRfmh2Tl
Malware Config
Signatures
-
Renames multiple (3433) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\micaut.dll.mui.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Internet Explorer\Timeline.cpu.xml.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayman.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_zh_4.4.0.v20140623020002.jar.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Java\jre7\lib\zi\America\Sitka.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Microsoft Games\More Games\MoreGames.dll.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.Client.resources.dll.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\vlc.mo.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libvdr_plugin.dll.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_ButtonGraphic.png.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Srednekolymsk.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_ja.jar.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Maputo.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libheadphone_channel_mixer_plugin.dll.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libsubstx3g_plugin.dll.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Windows Media Player\en-US\wmpnetwk.exe.mui.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Windows Media Player\fr-FR\wmpnscfg.exe.mui.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\mr.pak.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxml2.dll.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\Chkr.dll.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Windows Media Player\wmplayer.exe.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Dhaka.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File B.txt.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-private-l1-1-0.dll.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationCore.resources.dll.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\micaut.dll.mui.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MET.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\smtp.jar.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_ja.jar.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Java\jre7\lib\zi\America\Nipigon.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Microsoft Games\Minesweeper\ja-JP\Minesweeper.exe.mui.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Windows Journal\es-ES\NBMapTIP.dll.mui.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lindeman.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-lib-uihandler.jar.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_zh_CN.jar.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Baku.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Windhoek.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-spi-actions.xml.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Microsoft Games\Chess\Chess.exe.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Mozilla Firefox\Accessible.tlb.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libvdummy_plugin.dll.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_zh_4.4.0.v20140623020002.jar.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_ja.jar.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Printing.resources.dll.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\7-Zip\Lang\an.txt.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia_Banderas.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bangkok.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench_1.1.0.v20140512-1820.jar.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Microsoft Games\More Games\es-ES\MoreGames.dll.mui.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\Mozilla Firefox\AccessibleHandler.dll.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libtransform_plugin.dll.tmp 6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD51ba4194dc5787fe9281a4b6fc412b533
SHA1fb2be1f91d9e80c133c232f5c53de43b5add9367
SHA2562cc17fd0e5681a7a5c6f6f65e8dd97c23413e1e06491ab0b3539484bdff1cd57
SHA5127ac874473eeff09f20cb4fac138e44e8460ca8b53ff92fdc549287f187287110fa0c10288ce10a50fec12f25027744a408f95ac1a0a1f7d774b79d5d31333fff
-
Filesize
82KB
MD57eaa46c0481bb1b46c4391a850083301
SHA1ed37c47a0ae5ad7ff2ff783c3ce2dc83aa8f2e3a
SHA2563e2143c2309b17e9104507c00ddbe7a3c393a038ff2fa9e942feb2a9c1f07b5c
SHA5121fe6ca4c1ab536d5d341f625add16c1e36b6baf4a2561d2909c14524c84ec8fd7294df15363dcb2364737cc8126d661c7308b9a1ee93dc835e79278cd92e4b30