336be3a20ae8a36962ffd26b1ec7fb0ec2274a860dd9423b16ff817d29f1908a

Analysis

max time kernel
25s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2024 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
Size

29KB
MD5

77cbd091343b10c2be75931a0ce4f1ab
SHA1

45ec8ff2ff454638e75796575e2468b0ea2fb182
SHA256

c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07
SHA512

f3355d91d5ff74e46e0fd68abbd8b8c126e0b3391a4916b41c9c2005008ae6104c01c12b1512d2ee729ab379c2e61be755424f27da90a2b2964a8758f4b0b2dd
SSDEEP

768:Mef5bWAYY9njfp7pq7nD3kFkNXwrSBh0pPSEON9g74Y:h5x9u7nD0FkNArSBCvOe4

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\locale\ach\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_CN\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\Common Files\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\Mozilla Firefox\browser\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\da-DK\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gl\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\VideoLAN\VLC\locale\or\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File opened for modification	C:\Program Files\Windows Defender\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\Microsoft Office 15\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fur\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sq\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\VideoLAN\VLC\locale\as_IN\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bg\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cgg\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ms\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hu\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fi-FI\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\Java\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\Java\jdk-1.8\include\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\Windows Security\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\th-TH\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\Java\jdk-1.8\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fa-IR\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\Microsoft Office\root\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\Microsoft Office\Updates\Apply\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\hu-HU\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\Common Files\System\Ole DB\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\VideoLAN\VLC\locale\de\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\es-MX\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ms-MY\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ckb\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\CortanaApp.ViewElements\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File created	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\RESTORE_YOUR_FILES.txt	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 4796	3364	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe	26
PID 3364 wrote to memory of 4796	3364	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe	26
PID 3364 wrote to memory of 4796	3364	c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe	26

C:\Users\Admin\AppData\Local\Temp\c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
"C:\Users\Admin\AppData\Local\Temp\c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\delself.bat
  2⤵
  PID:4796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\RESTORE_YOUR_FILES.txt

Filesize
292B

MD5
4749876eec0450c2ca869428da5db7b5

SHA1
6d591510911ac2315702c1ea3705b8115653b873

SHA256
31163fcae4314f3e67a38597c93ae8f30d5d1d2c97ee95ccbac447aa1ba95ac0

SHA512
94e29db75377845e4355e3f401a99e9cb8f7a0150fb4cec51fdd4ea8187ab17561c1161b62af54ba36dbd809bbec28123d86212ba3884c5500ab00399658b4bd

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads