Analysis
-
max time kernel
53s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
12-11-2024 14:09
Static task
static1
Behavioral task
behavioral1
Sample
c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe
Resource
win10v2004-20241007-en
General
-
Target
c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe
-
Size
2.5MB
-
MD5
10ac63ad526ab652fa9d311908ac00e4
-
SHA1
ec1fd2c21fd534fa6807bb836e5d4bbb0204217a
-
SHA256
c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c
-
SHA512
70c6803b6388f5f9f5c995cd2ea8a4cc4c688743db76147a9a19c2aebab8e28eb8e11acfc59b9206c3386e8709561a79b8d784da1012a8000a6b572c7b313cf9
-
SSDEEP
49152:yWN3avHK72BX21c1XTxwDqoEZ/SGTip8uRXXYR0Hz:vcLBXjlcaZmxRZz
Malware Config
Signatures
-
Renames multiple (256) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exedescription ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPrintTemplateRTL.html.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\APPTL.ICO.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\ModifiedTelespace.ico.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\REMOTEL.ICO.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewFrame.html.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\about.html.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\settings.html.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\currency.html.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\NOTES.ICO.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\clock.html.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\calendar.html.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\IPML.ICO.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBlankPage.html.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsBrowserUpgrade.html.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPreviewTemplate.html.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\calendar.html.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SECURS.ICO.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\settings.html.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\ContactSelector.ico.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\SessionOwner.ico.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\Windows Journal\Journal.exe c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsBrowserUpgrade.html.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCDREQS.ICO.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCDRESNL.ICO.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\flyout.html.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\Java\jre7\Welcome.html.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\clock.html.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\XDPFile_8.ico.pif c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE c835200cec2de83edbfd2a71558434fd6dc153e61a62315e63a7b20275253c4c.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
544KB
MD5c0a74023b633fd962053fc9592d18b45
SHA160a77887f676650119d71cdb4e9cda7234235c8b
SHA256fa14ce0cead3ee68bfe224eb9a2a1ef85261265e31cbb9e4d509800c83338602
SHA512001f577f927ffe51c6152a68e2242245bb299a3cc2d76456b6aa6563e4321b18d728ee5c41dc90ca797c7b8aba16b00a0a2713a20bdace8b1b99d0fd9c4837bb