2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 19:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
Size

64KB
MD5

8106fb6fbe9be6816e8aeaa26cee9c44
SHA1

ba7c2d50a7c9262a7636b0ec2afd878649acb8f1
SHA256

2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee
SHA512

d32c37129b8dbe08d27c102f8130f2c91b41894710bdaaa9c515ac5d471ba2ef2715c8428caef307eda920c6a43e1f97260f17dfe1da9878f5772ce8e84ca719
SSDEEP

384:yBs7Br5xjL8AgA71FbhvhwMF1XxXEh+v8L1f1iw1jP8pW08yzXyRupIEb2IOG:/7BlpQpARFbhtF1XxXEhk8GMEpdX2Kll

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3700) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_ButtonGraphic.png.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpcore_4.2.5.v201311072007.jar.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_s.png.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\currency.js.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\librawvid_plugin.dll.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgradfun_plugin.dll.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.log.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help_3.6.0.v20130326-1254.jar.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-core.xml.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\icon.png.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_snow.png.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Los_Angeles.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_zh_4.4.0.v20140623020002.jar.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Windows Journal\it-IT\jnwmon.dll.mui.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-nodes.jar.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Java\jre7\bin\jabswitch.exe.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\vlc.mo.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libvdummy_plugin.dll.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_left_rest.png.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libscte18_plugin.dll.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxslt.dll.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\alt-rt.jar.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Tell_City.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_zh_CN.jar.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-spi-actions.jar.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Antigua.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\picturePuzzle.js.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\localizedStrings.js.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-execution.xml.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Java\jre7\lib\fontconfig.bfc.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Windows Media Player\wmpnssci.dll.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Windows NT\TableTextService\en-US\TableTextService.dll.mui.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Edmonton.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Java\jre7\bin\prism-d3d.dll.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgRes.dll.mui.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\http.luac.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\spacer_highlights.png.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_few-showers.png.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightRegular.ttf.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_zh_4.4.0.v20140623020002.jar.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_description_plugin.dll.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Windows Defender\MsMpLics.dll.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Windows Journal\de-DE\NBMapTIP.dll.mui.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.xml.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\README.html.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\slideShow.html.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_select-highlight.png.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Panama.tmp	2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe

C:\Users\Admin\AppData\Local\Temp\2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe
"C:\Users\Admin\AppData\Local\Temp\2c411906fb67002b1a70654841da7be9afd1eba626636d1ead5866392b5563ee.exe"
1⤵
- Drops file in Program Files directory
PID:2236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp

Filesize
64KB

MD5
c9b662392e91bdff8dd5092440da0575

SHA1
0c220c9e85e9e1ed6bc4827a1247b6e6346408b8

SHA256
f28b7fae191d62b15ff945ab3e4d732b7fa464f60e62914e3e5c595962ff0257

SHA512
6fc565b562c7dd306935768bb8173b21daa6d39211256c25f4fa35f1e71c01578ad98aa83b655117a58529ca0ffc7ce4ce55691ffacc5e648b684d04ddf60dfb

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
73KB

MD5
9a11037d1eabc7e8980d1da8e1eaeb1d

SHA1
6e70d07435a5e8635316496358c4daf17695f362

SHA256
d7909a82bf2641a223c6e6de6f77d82c19558d69c2cff8c75f0877c5aa7f49e6

SHA512
9dc26ce3192840825c7d0435c282f8d3463c83e5c420c699381a673e6134c9933a58ca80a02d1604c9390fb4a0562505b0b4fb4771df9e035f27143e097322d0

Download Submit
memory/2236-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2236-650-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads