Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/10/2024, 10:28
Static task
static1
Behavioral task
behavioral1
Sample
6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe
Resource
win10v2004-20240802-en
General
-
Target
6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe
-
Size
51KB
-
MD5
30a855b03ebd5f5cd25244a79097f340
-
SHA1
95c27237b10811f373e8ffe75ce6acbe6ae830d2
-
SHA256
6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ff
-
SHA512
85edad5226d42bfb42744f143a2190d1c3c092547151b59de1397c71460c970b18d3dbad4f9d313f846e881ab8dfe1fe4b121c1aa05abb0c3826a6449cc4ff78
-
SSDEEP
768:p7BlphA7dASbSLJJBZBZaOAOIB3jM2jMO/vY6mtPc:p7ZhA7dAxJJB7LD2I2IGYpPc
Malware Config
Signatures
-
Renames multiple (3228) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\plugins\demux\libmkv_plugin.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mahe.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Xml.Linq.Resources.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_srt_plugin.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\el.pak.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Bissau.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Cambridge_Bay.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\VideoLAN\VLC\lua\http\favicon.ico.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Internet Explorer\en-US\iedvtool.dll.mui.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\charsets.jar.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861261279.profile.gz.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-keymap.xml.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationProvider.resources.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_SelectionSubpicture.png.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Games\Mahjong\ja-JP\Mahjong.exe.mui.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\DVD Maker\Shared\DissolveAnother.png.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Games\Hearts\es-ES\Hearts.exe.mui.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IdentityModel.Selectors.Resources.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Linq.Resources.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libparam_eq_plugin.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\libdummy_plugin.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Brussels.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Yakutsk.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Java\jre7\lib\zi\GMT.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\PublishExpand.htm.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Java\jdk1.7.0_80\db\RELEASE-NOTES.html.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.ja_5.5.0.165303.jar.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Java\jre7\bin\keytool.exe.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\bckgRes.dll.mui.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspatializer_plugin.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\micaut.dll.mui.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tabskb.dll.mui.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_zh_4.4.0.v20140623020002.jar.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Dhaka.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Port-au-Prince.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\7-Zip\Lang\ba.txt.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Sakhalin.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tokyo.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher_1.3.0.v20140415-2008.jar.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\chkrzm.exe.mui.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_zh_CN.jar.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.png.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\VideoLAN\VLC\lua\modules\sandbox.luac.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_srt_plugin.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\7-Zip\7z.sfx.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ro.pak.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Stanley.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-ui.xml.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Resources.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Atikokan.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.xml.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe"C:\Users\Admin\AppData\Local\Temp\6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2216
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
51KB
MD596c15d724312919e334c510ba5ea3fb4
SHA1333699546bf2ee7d11bbef192d119a047e9a9b8e
SHA256f4bf1ee78bf017e8ddccba7d3732357c958c80c4a72983892ca412c1119171b5
SHA5123116ab9882430f6d56410b7362dcfbac883dd11fa91a14d6b5127c467d55640ff1c7532e402fa149f103215e043bed96ef1cb3175f5efc967ca37ec2673d84f5
-
Filesize
60KB
MD57750d9c4b12ea08e2e97d6d4fca7978e
SHA1145aff40f0a7bf1f23f089b6c83afe00746150c2
SHA256e0399d147a118a5b1617ecea15c1901447647efad7746a0ce9f8341944f94929
SHA5124493c722533f55cde4559dcb8615562850c6f02b37f96f43ea3d2ef3b3b72ed7f23724435d113dcee8ac967aa625a671aa143a0cd3249d037e87691bdf07808a