3c2338bf7cc73670e62428a3cb3de3ad72d298d52b7e374d29b96654c881997a

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 11:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2c6c61ccfe260f702d65b661c24a0f70N.exe
Size

70KB
MD5

2c6c61ccfe260f702d65b661c24a0f70
SHA1

ec0edfe4fffea59e2488865ff836bf29b46946b2
SHA256

3c2338bf7cc73670e62428a3cb3de3ad72d298d52b7e374d29b96654c881997a
SHA512

df8424c80135cdcd981633d16b5139c402d1e022362c2ca5f6b2bae5c15d283ccd0a7fd7f5d3a001450365d25cf37a11f72948f9c1c34f8ac4493fc1682ca3f3
SSDEEP

1536:W7ZppApBULcfpHLcfpX2/Nw/NwmxR2RWTWM:6pWpBwchcV2Wx5

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3162) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Internet Explorer\MemoryAnalyzer.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-threaddump.xml.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\ja-JP\Minesweeper.exe.mui.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IdentityModel.Resources.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_fr.properties.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kuching.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsFormsIntegration.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\DVD Maker\de-DE\WMM2CLIP.dll.mui.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\eclipse.inf.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvm.xml.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\LICENSE.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Urumqi.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libflac_plugin.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcfr.dll.mui.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Istanbul.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Cocos.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\vlc.mo.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tokyo.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Net.Resources.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Godthab.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_zh_CN.jar.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jre7\bin\server\jvm.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jre7\lib\jfr.jar.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jre7\lib\management\management.properties.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libfluidsynth_plugin.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hovd.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.xml.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-ui.xml.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ja_JP.jar.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Saipan.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_zh_TW.properties.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Mazatlan.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\vlc.mo.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\it-IT\FreeCell.exe.mui.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp_3.6.300.v20140407-1855.jar.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jre7\bin\WindowsAccessBridge-64.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Phoenix.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_specialocc_Thumbnail.bmp.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.xml.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_plugin.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\calendars.properties.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-9.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_ja.jar.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\DVD Maker\rtstreamsource.ax.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\ReachFramework.resources.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libd3d11va_plugin.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.dll.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Mozilla Firefox\platform.ini.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Louisville.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.zh_CN_5.5.0.165303.jar.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_ja_4.4.0.v20140623020002.jar.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Tijuana.tmp	2c6c61ccfe260f702d65b661c24a0f70N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2c6c61ccfe260f702d65b661c24a0f70N.exe

C:\Users\Admin\AppData\Local\Temp\2c6c61ccfe260f702d65b661c24a0f70N.exe
"C:\Users\Admin\AppData\Local\Temp\2c6c61ccfe260f702d65b661c24a0f70N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

Filesize
70KB

MD5
2ec4591f8eff08be2491b4f50c657233

SHA1
e7b155392de9bbfc8be5a330624c492aae31faea

SHA256
8ae0406485f2cefa49e376b85d7cfcee4cb09940132e21a2da831400fb4c1587

SHA512
4dc17de71793fb4cf925d825fbbaa3bcd4ee78f109b5b3f5261061efa086444320d602e12cbae57c0dcfed96b6943d54a63784a64b6fcfd30936aec66a22d093

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
79KB

MD5
da1249d7714bb7216177befc5639d301

SHA1
5fe39a1f1a8d2ce8160eb70847823a5d014ab2bb

SHA256
1297bbb42044a69635c9bb7194fb54744445804146cf678e51b8459c8480319f

SHA512
0a2a280b31a326459e25dca553014df64ac6fe0e1913f91599804385945b61780505708fde4aef9f3419d5a5eda0b2dae24e12b570185bfa573cb8b8eff30e37

Download Submit