0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 18:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
Size

73KB
MD5

c9c2358907648d44fee6ed45028ea77b
SHA1

81b39afed89f7227657dfa9245e08e38dd273194
SHA256

0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32
SHA512

7840fe1ea4c40e0662cb49238cacc5d0bc6751881a606bec9d7afd2a87fd0cd1ebb2838dc2983850d4627af036d63ecfc45d390895b97cc8685d107212f0f943
SSDEEP

768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcC+3mC+3meDAfABJ6fABJwEXBwzEO:/7ZQpApze+eJfFpsJOfFpsJ5Ddu7ey

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3706) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-plaf.xml.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\flyout.css.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\vignettemask25.png.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\derby_common.bat.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\gadget.xml.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\RSSFeeds.html.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-gibbous_partly-cloudy.png.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Folder-48.png.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Windows Defender\MpAsDesc.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\weather.html.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\bckgzm.exe.mui.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libvdummy_plugin.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Windows Journal\Templates\To_Do_List.jtp.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-modules-appui.xml.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw32.bmp.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.RSD.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Noronha.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Broken_Hill.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.common_3.6.200.v20130402-1505.jar.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationTypes.resources.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\gadget.xml.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcfr.dll.mui.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunjce_provider.jar.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montevideo.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Microsoft Office\Office14\MSOHEV.DLL.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\library.js.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\37.png.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rainy_River.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\jvm.lib.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface_3.10.1.v20140813-1009.jar.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\vlc.mo.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_zh_CN.jar.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Cocos.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Microsoft Games\FreeCell\fr-FR\FreeCell.exe.mui.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yakutsk.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs.xml.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libfreetype_plugin.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Windows Journal\fr-FR\MSPVWCTL.DLL.mui.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\clock.html.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\pdfshell.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sw.pak.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Monticello.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fakaofo.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_zh_4.4.0.v20140623020002.jar.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libschroedinger_plugin.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Campo_Grande.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe

C:\Users\Admin\AppData\Local\Temp\0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
"C:\Users\Admin\AppData\Local\Temp\0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

Filesize
73KB

MD5
c36e251e60888fe856089bfa60970377

SHA1
5f948039dad23e9c2b821f1bd2af26c133a158c3

SHA256
0b67f306831a366f80afcbc6ffda9b58a3dd3cb3a2aaed17d576dda2b1d8be2d

SHA512
689efe30c65fdd369c93a5a2c91000e41a78b9de15634c6e8302854184cbad91fe5910464e7fd71586cac5838ad11904abb5673fdd4a463a447bc543d8888109

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
82KB

MD5
9df73930338609c5c3bf82b5409e10ab

SHA1
a36d70c56f18fe7884e8d95c38e0a70fead2459f

SHA256
ffb0cb1ad39b0a68cdacf6c4f37fc49fdbd9266132e80727b2e97f14ea5d8e7f

SHA512
69c4693f6b6d27bbde7203e22962752dbf7e89f9170dcc0c1a85ba8ec7135bd54b7746597695591edb50af60daa295d3fed491a6cb883f2c1fcae9a00cecc80a

Download Submit
memory/1220-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1220-660-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download