a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/07/2024, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
Size

273KB
MD5

82ba7df5faf8137c577adbfbc7f0995d
SHA1

acdcb8c5b91572d5d2c598b04a5269e4c8c1bae2
SHA256

a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b
SHA512

45ecb5200f4c1bedf415b3f0704c2d3080aedfbe2791705ea40dd2e0ea13760136065fe754099504c4b9d7c2ae6fc5e068953223756851750930114ac9934d9d
SSDEEP

6144:RqBAIuZAIuDMVtM/8aB6Up31XnSUJdrIP42:CAIuZAIuO/6lXtrIt

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2796) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\msvcr100.dll.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Recife.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Amman.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Sofia.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Boise.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Auckland.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\epl-v10.html.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240389.profile.gz.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_zh_CN.jar.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-core-kit.jar.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Rio_Gallegos.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.h.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Ojinaga.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Sofia.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mip.exe.mui.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_100_percent.pak.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di_1.0.0.v20140328-2112.jar.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.lock.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.rcp_4.3.100.v20141007-2301.jar.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\UCT.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveNoise.png.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+3.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jre7\lib\zi\MST7MDT.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_ButtonGraphic.png.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glib-lite.dll.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Chita.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_SelectionSubpicture.png.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.c.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\masterix.gif.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-api.xml.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Ushuaia.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Microsoft Games\Hearts\en-US\Hearts.exe.mui.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_shmem.dll.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_zh_4.4.0.v20140623020002.jar.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-javahelp.xml.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\DVD Maker\Pipeline.dll.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives_1.1.100.v20140523-0116.jar.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_ja_4.4.0.v20140623020002.jar.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_zh_CN.jar.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-localization-l1-2-0.dll.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jre7\lib\accessibility.properties.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\ShvlRes.dll.mui.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\gstreamer-lite.dll.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_ja.jar.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
File created	C:\Program Files\Microsoft Games\Chess\Chess.dll.tmp	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe

C:\Users\Admin\AppData\Local\Temp\a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe
"C:\Users\Admin\AppData\Local\Temp\a0cc90ab1300a186f06b15e6f1ddb186cf79617b885d4f14cb5d73ae2974ef2b.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
273KB

MD5
4dde7a11eeb831468f802bf3b6a0ef6f

SHA1
c54385d173c9d95dd32ea81513327eff2cbc7fd2

SHA256
9eb196ee4be824f228110217b80a077c40bb8fd832e56066d2b09da69bbe3e9c

SHA512
cd8ec5aa36554f0202daf28187af348171b7cf4e331d0ac2ff260fb26ae32246a8bd7f997b6f003945d2683b55db5778ed888426dfedea839ebcc9ea421c53f0

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
282KB

MD5
cd6f5c8505cb412b0b48fc35a93bddbb

SHA1
76accdc42254bda86fab7ed25e8b89907e643927

SHA256
6eab8ae0aabec8cb4608c5b2791a79e5f76fe319a48e69783047dd39ace26baf

SHA512
4895c8b62ef569f9ef7dc55fbefea28735c6d1c7a5cd168bcab2f07fe54e2715d972ee26277558eda6aa1f9a57e6f857c33dd7a61a4afddf66d5a8e5367b04e5

Download Submit