61c11736e716afde6dcbf1bf9fe092d4a5dbed4bc50b1bd580dfb4a5750bb7c0

Analysis

max time kernel
120s
max time network
21s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 06:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6cfe54b45b7f8e9683ead4ebad05e770N.exe
Size

41KB
MD5

6cfe54b45b7f8e9683ead4ebad05e770
SHA1

9235efe360af71b5d1581042618dcbd633a521af
SHA256

61c11736e716afde6dcbf1bf9fe092d4a5dbed4bc50b1bd580dfb4a5750bb7c0
SHA512

9ca1d0307a7fa585cfea075c990d984834a2570b0f29aca74fa93dcb5cd41c37976063def1d89fabae90156d06c5ba8b28288e182e06c762711cffd043a4ae94
SSDEEP

384:GBt7Br5xjL9AgA71FbhvuNBN10wpAp/lvolGClvolGwTCus7sczBH:W7BlpppARFbhbt7Y7wTCnBH

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3151) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\lua\modules\simplexml.luac.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.xml.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cuiaba.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jre7\lib\zi\EST5EDT.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\chapters-static.png.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lindeman.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-convert-l1-1-0.dll.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jre7\lib\jfr\profile.jfc.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\DumontDUrville.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Kerguelen.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-loaders.xml.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-execution.xml.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\ReachFramework.resources.dll.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\README.txt.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_zh_4.4.0.v20140623020002.jar.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.security_8.1.14.v20131031.jar.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-US.pak.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\ReachFramework.resources.dll.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jre7\lib\cmm\PYCC.pf.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Sitka.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\BHOINTL.DLL.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-progress-ui.xml.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jre7\bin\gstreamer-lite.dll.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_mms_plugin.dll.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jre7\bin\tnameserv.exe.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Qyzylorda.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\ChkrRes.dll.mui.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\alt-rt.jar.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Puerto_Rico.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Yellowknife.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\decora-sse.dll.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_ja.jar.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jre7\bin\jawt.dll.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+1.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG.wmv.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\Shvl.dll.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jre7\lib\alt-rt.jar.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Merida.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Anchorage.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\vlc.mo.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\userContent_16x9_imagemask.png.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_zh_CN.jar.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-ui.xml.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.common_5.5.0.165303.jar.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-uisupport.jar.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipRes.dll.mui.tmp	6cfe54b45b7f8e9683ead4ebad05e770N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6cfe54b45b7f8e9683ead4ebad05e770N.exe

C:\Users\Admin\AppData\Local\Temp\6cfe54b45b7f8e9683ead4ebad05e770N.exe
"C:\Users\Admin\AppData\Local\Temp\6cfe54b45b7f8e9683ead4ebad05e770N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
42KB

MD5
35eade6d6a404d6d38cf7c798bb8d736

SHA1
b0b71b44b1237051da73b33a266b222458474d6c

SHA256
c8565855b818cd9f61ee27592a9e467fe5817a772fb9fbff61c290fc86d7ce61

SHA512
05d84ebc1dfaa1cf369cc8ebe7829d8d7ae97d74ce081f8f4081678b2d8c42eb2607fbf7ba687c4d38e40c3783eebf9b2746808e48c07c9683f340a86fb03960

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
50KB

MD5
f47112d264354c7cbfc48d25067ddf5d

SHA1
b75f9de09d6de8a66b0f73e4c32f14946e6ab4aa

SHA256
c6f6e3e64c71382b9dc3f24456fa629ab6ac128c50bbaf9447e3f698b10c078a

SHA512
fae505892a7afd098063f7c7866ed5bd3f3db959e258414e81d32166aeb9b03964b8ad7a5a0b01ced0812dec842aa10cbbe1e339c808cd0d06ec1ce9ee73fd76

Download Submit