a936c10fd2cf9885845e99ba946054652704db41b5e3be757bcf03e47a13c66b

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c601e928832633520ff2a01326f568b0N.exe
Size

89KB
MD5

c601e928832633520ff2a01326f568b0
SHA1

34a55bff77ad99b0bc1bed0c83fbb805b909d693
SHA256

a936c10fd2cf9885845e99ba946054652704db41b5e3be757bcf03e47a13c66b
SHA512

ec54bcd3a98bb2a9b2833bcb3bee48724a6c6a2ecdbce9589ede6413e6a26f1a9ba5ccce38bb85c71bc44bb1e594b7d4808aefe4d5648652498c6a2c917db91e
SSDEEP

1536:W7ZhA7pApH9QHwtRF9ESWu0SWujodsodaNovTW+SPL+cycWAF689i4:6e7WpHIyRF9ESWu0SWujKsKRsP9fVL9r

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3180) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.runtime_3.10.0.v20140318-2214.jar.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_zh_4.4.0.v20140623020002.jar.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiler.xml.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-options.xml_hidden.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\vlc.mo.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\GoldRing.png.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\splash.gif.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_ja_4.4.0.v20140623020002.jar.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_SelectionSubpicture.png.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nl.pak.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-remote.xml.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.resources.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\WET.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_ja_4.4.0.v20140623020002.jar.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.bidi_0.10.0.v20130327-1442.jar.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\vlc.mo.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Mozilla Firefox\xul.dll.sig.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\vlc.mo.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\CIEXYZ.pf.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Bermuda.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_ja_4.4.0.v20140623020002.jar.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.xml.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.change_2.10.0.v20140901-1043.jar.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Port-au-Prince.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IO.Log.Resources.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ja.properties.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-settings.xml.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-heapdump.xml.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Mozilla Firefox\AccessibleHandler.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Entity.Design.Resources.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Riga.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\es-ES\Minesweeper.exe.mui.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\vlc.mo.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_ButtonGraphic.png.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qatar.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jre7\bin\t2k.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiler.jar.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Microsoft Games\Hearts\ja-JP\Hearts.exe.mui.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libscreen_plugin.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsubsdec_plugin.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdca_plugin.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\cacerts.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santo_Domingo.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Brussels.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_zh_4.4.0.v20140623020002.jar.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.dll.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.app_1.3.200.v20130910-1609.jar.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net.nl_zh_4.4.0.v20140623020002.jar.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\DVD Maker\it-IT\DVDMaker.exe.mui.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\chapters-static.png.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\th.pak.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hong_Kong.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EET.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Lisbon.tmp	c601e928832633520ff2a01326f568b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.filetransfer_5.0.0.v20140827-1444.jar.tmp	c601e928832633520ff2a01326f568b0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c601e928832633520ff2a01326f568b0N.exe

C:\Users\Admin\AppData\Local\Temp\c601e928832633520ff2a01326f568b0N.exe
"C:\Users\Admin\AppData\Local\Temp\c601e928832633520ff2a01326f568b0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

Filesize
89KB

MD5
d14dc90b0b2ad83efb15953120b10d3f

SHA1
ea5333a56b82a696e70ed99910cc5e9394b8eece

SHA256
79285dc03e1e8636380cdb399ae8771beba7e39686c8bfb4efd847d94c05cbe2

SHA512
533fcd780bddc90239af6661dcb777bcf66149ccc3d8e71e2946d9e63d5f07139dbc5273066b9a60dfe2a116e50cb8a26aa4c617444831f3f56e4f34c67ecf02

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
98KB

MD5
e024a3a507816e0ca569ea8dfbb62c88

SHA1
0abcbc0564323e1e4b0d7a534249d0d89817d8ca

SHA256
e6631bf2666446a6ebecd99657fc77c3eedc1fc565adc359d7fdce7dba9d0478

SHA512
c01e3127efad40170d9acfac35c1325db15fc38932477bb4cc1521beb4e76e9aa38696df4f6dac3e5086e0b23b80708215f7d3b34d5330725e4f6a93fc9c1704

Download Submit