Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
13-08-2024 16:26
Behavioral task
behavioral1
Sample
6bd65a4a1c85b51ffbeeb8d6d2205020N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6bd65a4a1c85b51ffbeeb8d6d2205020N.exe
Resource
win10v2004-20240802-en
General
-
Target
6bd65a4a1c85b51ffbeeb8d6d2205020N.exe
-
Size
54KB
-
MD5
6bd65a4a1c85b51ffbeeb8d6d2205020
-
SHA1
407acda44e92fb8e913cefd1d1e27236174725e8
-
SHA256
91d6081bea46f431b15cc8cc736551088990c12e43aeb2e98eb6d1dbd282f550
-
SHA512
382ef4e7f5851a11721a937f90a7f86092cd4df4d1fbfa2ebe1228e777f2ee5fdd3a9c50fae927f4f025716ffad70da05424fc62f1ae9b03712462251d666c9f
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATNyIHAJvHAJLMFp:V7Zf/FAxTWoJJZENTNy3p
Malware Config
Signatures
-
Renames multiple (329) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2296-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000c000000016d28-2.dat upx behavioral1/files/0x0002000000010463-6.dat upx behavioral1/memory/2296-70-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeush.dat.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fr.pak.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\7-Zip\Lang\ne.txt.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\cloud_Thumbnail.bmp.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\DebugReceive.ico.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\chapters-static.png.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\cs.pak.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\7-Zip\Lang\bg.txt.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Common Files\System\msadc\handler.reg.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground_PAL.wmv.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es-419.pak.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\7-Zip\Lang\th.txt.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\DVD Maker\fr-FR\OmdProject.dll.mui.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonSubpicture.png.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Internet Explorer\iedvtool.dll.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_SelectionSubpicture.png.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\DVD Maker\it-IT\OmdProject.dll.mui.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\DVD Maker\OmdProject.dll.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Internet Explorer\pdm.dll.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Subpicture1.png.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\MSTTSLoc.dll.mui.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcfr.dll.mui.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\DVD Maker\fr-FR\DVDMaker.exe.mui.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\CircleSubpicture.png.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe File created C:\Program Files\7-Zip\Lang\fy.txt.tmp 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6bd65a4a1c85b51ffbeeb8d6d2205020N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD5c168e580eab39b7f8c2cc02bdf837806
SHA11bd1335ff64f4381a19277b9e544dc6f4425f62c
SHA256c4df3c6710835ce5cacfab32593d949e97aa8b471bf3d965d70cd0a738bc28e3
SHA512c24dde5bfeeeff5e7fd83868629be554a9b1449378ea15c3d4fb0a0e46996d2b532e3f7bf13106c57df5d763ef7c576404fea3c012546cf63feeb6dcfa34775b
-
Filesize
63KB
MD5eb09cc0553c05892c3174e6f8b01a09e
SHA11ee1e511c4230a6af94fa830c426335c08b8b471
SHA256dfa822fd2b67d7c966ab6ebbc327f9df710b7df1e6e16721d3e8b1cd6028c1de
SHA512430b085845593e87b461f392da116ac8b68f9acffa13fa0dda6c670e3e2f68ff756ef65209294a6cd19f21164ce3b7eef6208cb151d950f7c788015bd9dcb3aa