Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
14-11-2024 23:01
Behavioral task
behavioral1
Sample
6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe
Resource
win10v2004-20241007-en
General
-
Target
6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe
-
Size
40KB
-
MD5
4c1219df18de3886fbe65bd327bd81f7
-
SHA1
d4669db223310bc334d5ac24ca157f4b7eb48cab
-
SHA256
6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511
-
SHA512
e5870088159681b726c6f3ea8d6da70f1039679bdc2dff477f709111be0f6abea60d8687f6e76ca12bfb901a4179a57e52daf13430efef32d6d55953622369a7
-
SSDEEP
768:kBT37CPKKdJJTU3U2lRtJfOn33EskmKs333EskmKs4gNAgN0:CTW7JJTU3UytJfOEfmKjfmKEH0
Malware Config
Signatures
-
Renames multiple (1178) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
resource yara_rule behavioral1/memory/2208-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000b00000001225c-2.dat upx behavioral1/files/0x0002000000010420-6.dat upx behavioral1/memory/2208-26-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exedescription ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\7-Zip\Lang\tt.txt.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSLoc.dll.mui.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\DVD Maker\OmdProject.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Helsinki.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.properties.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\vistabg.png.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\DVD Maker\soniccolorconverter.ax.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Volgograd.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Warsaw.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Niue.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground.wmv.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\IPSEventLogMsg.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_ButtonGraphic.png.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Madeira.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\7-Zip\Lang\br.txt.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Whitehorse.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.xml.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\DVD Maker\ja-JP\DVDMaker.exe.mui.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Irkutsk.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.security.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.properties.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\7-Zip\Lang\ast.txt.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\accessibility.properties.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Internet Explorer\JSProfilerCore.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\calendars.properties.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kiev.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\7-Zip\Lang\az.txt.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsound.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Casey.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Rome.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Jujuy.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\msvcr100.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Java\jdk1.7.0_80\include\jdwpTransport.h.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe"C:\Users\Admin\AppData\Local\Temp\6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2208
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD5447f69984adf2add4725ec9383e265da
SHA17a3153ec0d8a69cd9e1b424ae68d0ef344bc4798
SHA25690518d0fac1e5f2f4fe2d9fe42028af9e88b474cb6e17d17d9edda53b016324a
SHA51228f06b1bbb07e7902bb68556a16442e39d2ec4a0ea28cbc69001e1c2653aca075eb7c700b87c9c9db6a3bf94e36c8bad30bd7d7e52f423f28ff6c771ac7643c9
-
Filesize
50KB
MD55ea63ae9edfe3e9be8beeef10b34cee6
SHA1f360006c47d4b94e6f13fe209266d75ee4cf3c7d
SHA256d0ade2aa4aaaa58fdba7861ae5444644a5c1cea5c9f41cc10d31efd4e48086d5
SHA5126d5542a901f37971c6e7811a44dec00b62d8e5b1cb64a28b966fa69c84d91bb76fbe74283fc8f491d9686f0f116b62b76249b5a670a868b33b962936feee46e8