8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
02-08-2024 02:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
Size

33KB
MD5

137392edba573baf2c6fd3a046818b62
SHA1

8c494f27ccfcffe338c96f92461ed4474383aa4c
SHA256

8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f
SHA512

5335c8a51cd0beb2378012f278cb548528575357530b7b8674229d0ac24bdae5245c6824567bbe204f2feba7e17e22c9fca6d232eaf3f2fda5d0f4d63ffa502c
SSDEEP

384:GBt7Br5xjL9AgA71Fbhv7bhvo42L5FgAytBpR42L5FgAytBpVA+:W7BlpppARFbhjbhg42LcfpR42Lcfpu+

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3433) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.jar.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.DataSetExtensions.Resources.dll.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_wav_plugin.dll.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Internet Explorer\MemoryAnalyzer.dll.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\hprof.dll.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Macau.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Phoenix.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Microsoft Office\Office14\OLKFSTUB.DLL.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mp4_plugin.dll.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net.nl_zh_4.4.0.v20140623020002.jar.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-text.jar.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\vlc.mo.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\vlc.mo.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\1047x576black.png.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\DVD Maker\sonicsptransform.ax.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libaudioscrobbler_plugin.dll.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.smil_1.0.0.v200806040011.jar.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Easter.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.ja_5.5.0.165303.jar.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libnfs_plugin.dll.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Norfolk.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\uarrow.gif.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jre7\bin\javafx-iio.dll.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Efate.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240811.profile.gz.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-private-l1-1-0.dll.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\vlc.mo.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+7.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_standard_plugin.dll.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\EST5EDT.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Aqtobe.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\DVD Maker\OmdProject.dll.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-utilities.xml.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Jamaica.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hebron.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jre7\bin\server\jvm.dll.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\logging.properties.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qyzylorda.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\ct.sym.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClient.resources.dll.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\artifacts.xml.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Center.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin_2.0.100.v20131209-2144.jar.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_zh_4.4.0.v20140623020002.jar.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IO.Log.Resources.dll.tmp	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe

C:\Users\Admin\AppData\Local\Temp\8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe
"C:\Users\Admin\AppData\Local\Temp\8ccec3f1fb134e7c1e437e6559f1fc23e083ac611a273927a3a502575cec1a0f.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini.tmp

Filesize
34KB

MD5
64aa46ae6cfa6f5907d2e4cc79c7759a

SHA1
a9a9d489a8e34d018b11d4f2bb6ea518a3ae3b3e

SHA256
3ce0c798a255effb566b7cd9df4a4e4263e39a694c56dcdb8b4373d5ead22c83

SHA512
640a7acc6d9adb903789bc2e9560ec59dc55356f0dd25b95d11b5b43ad6ee1443e7d113885fea350d9c4165e7ef3a3b8b2f56e5be80c5a7349393d553104cba5

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
43KB

MD5
308b09ec04b4dd7a9f3464660fec3a01

SHA1
b16ecf6ca9ffeab5431c02df0c8cb22fc40dde7a

SHA256
f6a44f924fd5b73de276e8089e32adbed8d8519dc9bf6df4d0f9939a754d98f2

SHA512
976f03077e1401d41d6f5f48b1025485190551849803133561ce4714c3e4b57c27f83861187bb9a8cba57232f6bd40c27496a64ba3ce709e0086b6562437cc43

Download Submit