c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9

General

Target

c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
Size

156KB
MD5

4a2c7295771216a38836758181eb0ac6
SHA1

d197da3c3966469ed7488d09bbfbc0098b0a337a
SHA256

c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9
SHA512

e28bc8a22dedcd5bdb0f5ce0a807db31e79cd1870efafbb7ad19a4f6723699ae1e11ddb1262754d285608b05b9121c242e4cc976e319ebbbd850715bac2832a9

Score

8^/10

ransomware spyware stealer

Malware Config

Signatures

Modifies extensions of user files 4 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\MountBlock.tiff => C:\Users\Admin\Pictures\MountBlock.tiff	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File opened for modification	C:\Users\Admin\Pictures\MountBlock.tiff	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File renamed	C:\Users\Admin\Pictures\JoinResolve.tiff => C:\Users\Admin\Pictures\JoinResolve.tiff	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File opened for modification	C:\Users\Admin\Pictures\JoinResolve.tiff	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe

Drops startup file 1 IoCs

Processes:

c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops desktop.ini file(s) 54 IoCs

Processes:

c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Public\Videos\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Public\Documents\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\Searches\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\Favorites\Links\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\Pictures\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\Music\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\Videos\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Public\Libraries\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\Links\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\Contacts\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Public\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Public\AccountPictures\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\Favorites\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Public\Pictures\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Public\Music\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Public\Downloads\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\Downloads\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\OneDrive\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\Desktop\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\Saved Games\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Public\Desktop\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\Documents\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
File created	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe

pid process

1972 c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe

pid	process
1972	c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe

C:\Users\Admin\AppData\Local\Temp\c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
"C:\Users\Admin\AppData\Local\Temp\c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Suspicious behavior: RenamesItself
PID:1972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads