6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
Size

43KB
MD5

c7ddc206d6118571bb82a886b6502f08
SHA1

ec342054e8ef6052f5108d4776e7d7b442017bf1
SHA256

6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e
SHA512

81f5188c63c89771bf8b956511e07824ba6c0a734d2d38865ac39bd45c7f6a0bb8a29be957711cb196e3a6d1c5150cb8c00f108c462ae83890acf8546a08f214
SSDEEP

384:GBt7Br5xjL7lAgA71Fbhvt3Gb9CGDb9CGBjUDXV8gcjUDXV8g3:W7Blp9pARFbhOCQCPjt

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3752) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Madeira.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_ja.jar.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\drag.png.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\CompleteConvertFrom.png.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt_1.1.1.v20140903-0821.jar.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_h.png.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_100_percent.pak.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodicon.gif.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Mozilla Firefox\mozwer.dll.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\gadget.xml.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\Tulip.jpg.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nl.pak.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyclient.jar.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh001.htm.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\toc.xml.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Java\jre7\bin\w2k_lsa_auth.dll.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Java\jre7\bin\WindowsAccessBridge-64.dll.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\logo.png.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\sentinel.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIcon.png.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\selection_subpicture.png.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Internet Explorer\en-US\iedvtool.dll.mui.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-6.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_top_left.png.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\hxdsui.dll.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\DVD Maker\Shared\Common.fxh.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\34.png.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\ShvlRes.dll.mui.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Novosibirsk.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Windows Journal\jnwppr.dll.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\picturePuzzle.html.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Subpicture1.png.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.xml.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Johannesburg.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Microsoft Office\Office14\OLKFSTUB.DLL.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\Flash.mpp.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_preferencestyle.css.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_zh_CN.jar.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\vlc.mo.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\jquery.jstree.js.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist_jstree.xml.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext-down.png.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Eirunepe.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4_1.0.800.v20140827-1444.jar.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_s.png.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Adak.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Matamoros.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\vocaroo.luac.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\HLS.api.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL.tmp	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe

C:\Users\Admin\AppData\Local\Temp\6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe
"C:\Users\Admin\AppData\Local\Temp\6c5318eec3fbe1d5f343929e50ad1be98cfbcdcfb6d3f2195be2ad239e212a1e.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

Filesize
44KB

MD5
6ca8403c6b6900784df7ce037fd11510

SHA1
e1ebbe03924258755c96f9bd5ec5dacdca196317

SHA256
936f04082da17993b0089d03e72c094c84251fb79935731af49fee1e6a7d4e46

SHA512
deee51c742d86c717af7d701a79b7287e592bfd0a181ed98c5ac6134a2193652e2e4ee63cb8823a4922f3e82dde1ac13096833c8fbac7b00aa0719035f0db4df

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
52KB

MD5
b0aef30556f5350bd2dc2a8332221ade

SHA1
1cacb100913185a9be5c2163ddd76b375ba34405

SHA256
6b2b3346bcf50151ff2da78e36b51a55aa106983dce011d59c562f7d993ae36f

SHA512
01848ec667da1a3bd7c2991be307e8d4b22dc4c01db48e3ae824e87cb04de375319975b37114b98b320679dba6d52edc6e1b7dd7ec7cda08d453cecb64b18ffd

Download Submit