6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 22:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
Size

72KB
MD5

9d183c314f13d9f9891e9dd3a8d5b752
SHA1

6e8b88a09ebbece0bba4c69e8cfd4b1ca23f7f18
SHA256

6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827
SHA512

2e9ef509535ea22ed5f9d0c18f3c8420f55646eb6d8cc79e271a6206f6cfc2e089cad6076919c31f6420f8803de28d83c4389ce90d1ceece41d2d1534d4a682a
SSDEEP

1536:W7Z+pApfGQ3y3RWvfmRfm9sKsSd5GT6Sr:6+WpDfmRfmh2Tl

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3433) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\micaut.dll.mui.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Internet Explorer\Timeline.cpu.xml.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayman.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_zh_4.4.0.v20140623020002.jar.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Sitka.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Microsoft Games\More Games\MoreGames.dll.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.Client.resources.dll.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\vlc.mo.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libvdr_plugin.dll.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_ButtonGraphic.png.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Srednekolymsk.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_ja.jar.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Maputo.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libheadphone_channel_mixer_plugin.dll.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsubstx3g_plugin.dll.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Windows Media Player\en-US\wmpnetwk.exe.mui.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Windows Media Player\fr-FR\wmpnscfg.exe.mui.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\mr.pak.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxml2.dll.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\Chkr.dll.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Windows Media Player\wmplayer.exe.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dhaka.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File B.txt.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-private-l1-1-0.dll.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationCore.resources.dll.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\micaut.dll.mui.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MET.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\smtp.jar.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_ja.jar.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Nipigon.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\ja-JP\Minesweeper.exe.mui.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Windows Journal\es-ES\NBMapTIP.dll.mui.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lindeman.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-lib-uihandler.jar.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_zh_CN.jar.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Baku.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Windhoek.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-spi-actions.xml.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Microsoft Games\Chess\Chess.exe.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Mozilla Firefox\Accessible.tlb.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libvdummy_plugin.dll.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_zh_4.4.0.v20140623020002.jar.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_ja.jar.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Printing.resources.dll.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia_Banderas.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bangkok.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench_1.1.0.v20140512-1820.jar.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Microsoft Games\More Games\es-ES\MoreGames.dll.mui.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\Mozilla Firefox\AccessibleHandler.dll.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libtransform_plugin.dll.tmp	6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe

C:\Users\Admin\AppData\Local\Temp\6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
"C:\Users\Admin\AppData\Local\Temp\6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe"
1⤵
- Drops file in Program Files directory
PID:2124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

Filesize
73KB

MD5
1ba4194dc5787fe9281a4b6fc412b533

SHA1
fb2be1f91d9e80c133c232f5c53de43b5add9367

SHA256
2cc17fd0e5681a7a5c6f6f65e8dd97c23413e1e06491ab0b3539484bdff1cd57

SHA512
7ac874473eeff09f20cb4fac138e44e8460ca8b53ff92fdc549287f187287110fa0c10288ce10a50fec12f25027744a408f95ac1a0a1f7d774b79d5d31333fff

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
82KB

MD5
7eaa46c0481bb1b46c4391a850083301

SHA1
ed37c47a0ae5ad7ff2ff783c3ce2dc83aa8f2e3a

SHA256
3e2143c2309b17e9104507c00ddbe7a3c393a038ff2fa9e942feb2a9c1f07b5c

SHA512
1fe6ca4c1ab536d5d341f625add16c1e36b6baf4a2561d2909c14524c84ec8fd7294df15363dcb2364737cc8126d661c7308b9a1ee93dc835e79278cd92e4b30

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads