b1968b4be3f82fc26b1e2decdcb8f532915aed847603aeeaf254722bdd411d26

Resubmissions

16-03-2024 17:17

240316-vtswysfd2y 10

16-03-2024 15:31

240316-syg9xafg39 10

15-03-2024 08:15

240315-j5rmgsbg5z 10

Analysis

max time kernel
173s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 08:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
Size

23KB
MD5

71d9e6ee26d46c4dbb3d8e6df19dda7d
SHA1

a88176cdd3df153349104442eac4e2d1c416e457
SHA256

ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda
SHA512

d6a61d6d32bf636bec7948323a422116b359dadf78e55327633ad5c3de41e6c15dcadd27a8c53453ef14dd63184c22dee82420b99338f5cc7359e9f6ec50cca7
SSDEEP

384:eebFNw4Pk1itKkpAjjI2Ypdm/nYi/8lhRea16Wv88oyLOixGqKWW0o:e0FmBkpKjPYpudR4v8x3iAE

Score

10^/10

persistence ransomware

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\HOW TO DECRYPT FILES.txt

Ransom Note

All your important files were encrypted on this computer. You can verify this by click on see files an try open them. Encrtyption was produced using unique KEY generated for this computer. To decrypted files, you need to otbtain private key. The single copy of the private key, with will allow you to decrypt the files, is locate on a secret server on the internet; The server will destroy the key within 24 hours after encryption completed. Payment have to be made in maxim 24 hours To retrieve the private key, you need to pay 3 BITCOINS Bitcoins have to be sent to this address: 1NJNG57hFPPcmSmFYbxKmL33uc5nLwYLCK After you've sent the payment send us an email to : fast_decrypt_and_protect@tutanota.com with subject : ERROR-ID-63100778(3BITCOINS) If you are not familiar with bitcoin you can buy it from here : SITE : www.localbitcoin.com After we confirm the payment , we send the private key so you can decrypt your system.

Emails

fast_decrypt_and_protect@tutanota.com

Wallets

1NJNG57hFPPcmSmFYbxKmL33uc5nLwYLCK

Signatures

Renames multiple (1943) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\en6n2s2nFSTC0R9.exe"	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe

Drops desktop.ini file(s) 11 IoCs

Processes:

ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\desktop.ini	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-2461186416-2307104501-1787948496-1000\desktop.ini	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2461186416-2307104501-1787948496-1000\desktop.ini	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe

Drops file in Program Files directory 64 IoCs

Processes:

ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.zh_CN_5.5.0.165303.jar	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ja_5.5.0.165303.jar	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-common.jar	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.RunTime.Serialization.Resources.dll	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\topnav.gif	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_zh_4.4.0.v20140623020002.jar	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.el_2.2.0.v201303151357.jar	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\HOW TO DECRYPT FILES.txt	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_ja.jar	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Java\jre7\lib\ext\sunmscapi.jar	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsoundds.dll	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ext_5.5.0.165303.jar	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_zh_CN.jar	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-print.xml	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonSubpicture.png	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\HOW TO DECRYPT FILES.txt	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\eclipse.inf	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director_2.3.100.v20140224-1921.jar	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\HOW TO DECRYPT FILES.txt	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_ja.jar	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha2.png	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_win.css	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\tr.pak	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\tpcps.dll	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport.png	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-explorer.xml	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata_2.2.0.v20131211-1531.jar	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\MergeNew.bmp	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunmscapi.dll	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationBuildTasks.resources.dll	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Microsoft Games\More Games\de-DE\MoreGames.dll.mui	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-applemenu.xml	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\Common.fxh	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jmx.xml	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sa.xml	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationTypes.resources.dll	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\awt.dll	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_zh_CN.jar	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.RunTime.Serialization.Resources.dll	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-uisupport.xml	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler.nl_zh_4.4.0.v20140623020002.jar	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_ja.jar	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\msinfo32.exe.mui	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_zh_4.4.0.v20140623020002.jar	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IpsMigrationPlugin.dll.mui	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_highlights_Thumbnail.bmp	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe

Modifies registry class 10 IoCs

Processes:

ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BHIIFQHRNPIFYZO\DefaultIcon	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BHIIFQHRNPIFYZO\shell\open\command	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BHIIFQHRNPIFYZO\shell\open	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.fast_decrypt_and_protect@tutanota.com	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.fast_decrypt_and_protect@tutanota.com\ = "BHIIFQHRNPIFYZO"	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BHIIFQHRNPIFYZO	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BHIIFQHRNPIFYZO\ = "CRYPTED!"	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BHIIFQHRNPIFYZO\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\en6n2s2nFSTC0R9.exe,0"	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BHIIFQHRNPIFYZO\shell	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BHIIFQHRNPIFYZO\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\en6n2s2nFSTC0R9.exe"	ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe

C:\Users\Admin\AppData\Local\Temp\ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
"C:\Users\Admin\AppData\Local\Temp\ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
PID:2720

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2461186416-2307104501-1787948496-1000\desktop.ini
Filesize
129B

MD5
183a3c38b0cecfec6e071e5e0230c9d5

SHA1
512f4f9f160af1a4097d087a8537c286dd19783e

SHA256
dbcb7097128d51acaf60685dc7bb849d57499d4ce521e584166421f6d17a3cc1

SHA512
41f4510596979981d2fd13c20974af7a1a6a3f9ab205c54753f92bee3b75b7c2e65d5292db0b9ee932dede48c1b3e10074c2a7a6509cd00dabc2e169467e36c4

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\HOW TO DECRYPT FILES.txt
Filesize
957B

MD5
a6120ea15b3e9776ed01eb70cb9dc2c7

SHA1
584b21ee76415e04e8e437ac8ded20ded3fdda86

SHA256
5f8cf6fc0b8da0e8ae1afd12ae7c7dbb63a2e8c8fb0cec3bce4abf83dbdbade1

SHA512
9892c254bddace38de963421bfc30a6ac55eea5386a6aadb2bf168184ad9faa10310474404434d1b314b4810d582daa00f601e292acd77e9b5172bdba7dfbf0d

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\msvcr100.dll
Filesize
809KB

MD5
708a6f85cabf0b22c4baaff9363c41c5

SHA1
a8b65d95f95a4a3b0d86e202037026634e3fd704

SHA256
9a914a4510e0e129d9737aa6c208feb1144e90d777e8982d17c019c0fbb563ef

SHA512
a046b674a149baf159787b29a1e89cdf4ecd6fd15153b4b71a786e9717249e16dc1c02d43a07e1727386895dbadf538d9859fc882c2575fc1513191c74c2cc3a

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif
Filesize
153B

MD5
a9a776eb0893e42d74ce9b26cfca1465

SHA1
00a6d5d357c215e58e2b0563bd500d59b4a821f2

SHA256
c4f10c853484c0aaae1cf91dd84b0fe472096376b3af93db72f7232d4bd2d992

SHA512
d7482b8ba540a39b9917e7f408d166dfd9401b7c88ecedd05049a16524b5982b17ed7504f1e001edef027dd27294ba5238129a4769ab979e9c7a5b0ce095a6bf

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize
12KB

MD5
840b756da93eb68d7c7874b1102de622

SHA1
62960149974a0b99a166f3bccf85c4fdbb0a56cd

SHA256
2d8b29c004d2bd927093a03310abd29c572328044208cce8c137810630cccb9a

SHA512
ab07ddf1b0650f03ed1f14d7fa0ed49002920b9390995f2702ed6ec6001aeb29fee7c8e1c960962397c3c3477d4b242d109286ddf88248ee7eaa6eff5b8a6818

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize
8KB

MD5
7f0b20c2fd1135f17e8ab4359d113416

SHA1
425cb0afa3b025b0a13f29c47193fd5ae5c5da9c

SHA256
9d9e7db6e107dd55c70105a42ee1fe8aec40d2d3ed1950971d606625d99d89da

SHA512
41ff22b255b2de26977a18350eb8e67500bee6375f32da3fcea0d68b8cfcf710e2e4f2438326bc9f00773fd677602ec56a154c63f8a77cf8d68e6fb37b116e0f

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf
Filesize
57B

MD5
c1cd0d3c8780ba3d7edf45b3d1e76c25

SHA1
8adc10564e2e21ad75ef9af30051777c3c1defd2

SHA256
cb3842bce9192100a721a7170c967c3ed3b91830599b3c62251df9256caf4dfd

SHA512
f343a1e87070831b9255f0334a840a48fea4343ce2168d8c95b51b5461cd30589a0397a6b2d6de42ec1dfb33dbb43cd5a6a9c51770218748c720a265f03e1265

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
Filesize
11KB

MD5
4a939383a8879d5c298cd64b5e282fb4

SHA1
545c6971c9a7eee80e37d1672a74d71a4acb652c

SHA256
3cba054381559a4c32cbf2eadeb84e9a9cbad0822eecff1a9a14cda3d901b007

SHA512
f8bb642a63ba02891568e666eb38032ab99bb6f6b24b9c3a73b5ea662517917c54210d9649774142d8546109e37b84b97d2c2b32569f2e6ff2b9091af42f3ada

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt
Filesize
109KB

MD5
80aa92ade0728895f0838e133dfb927f

SHA1
b4b305e766522c7ff5ac77a4e4b749699f3f9dda

SHA256
c91d02a262593b22bb28839478e897a5dcf93398fc43b95471dfe3dc1e97369c

SHA512
a239c1e2c7b60277b3281bad2516dc3c939796556cbdfb04ecf558e9e1de13ca8a07cad6480ed80c1c9e0ef2d02b7bdf80b66cda55734b6ebeb6208f38a418bc

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt
Filesize
172KB

MD5
d40d4091c20f8068831c1b2b2e8f72e1

SHA1
fd6a52fc453f4f575c279e66446712e399066e17

SHA256
8ad819d002bc56e4860f37b8d301990e3c229e1581ee6b5401ffcd229a434912

SHA512
6037e829caff0b4fc9ce71c3d355c22318a27f5dd984e23392adf042518489965f5eccd326dbf8b2ba4259dbbdd36d75bf08de8ce1ece712344def9080e099bd

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads