f6b76ab9bd65d1edea17f4152427dfb50c69f659f0ec14c11af91f1d5c86ca2c

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 20:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc5604c8e91d439c459871963fbadd50N.exe
Size

46KB
MD5

cc5604c8e91d439c459871963fbadd50
SHA1

b604a0438d3d93e5ded3b018365ffdbd7751e5bd
SHA256

f6b76ab9bd65d1edea17f4152427dfb50c69f659f0ec14c11af91f1d5c86ca2c
SHA512

2afaed2bbbf5e3d6bf05a8e553e595179dd86dfe681c034e3c2c51d730d16d711abafe5e103d5e39c6c4acc86bea126fa1e4393ea45fc6989d674a06393c1704
SSDEEP

768:W7BlpppARFbhHFoqAJwBqAJw1VyjVyokB:W7ZppApyVyjVyP

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3168) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\currency.data.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\dnsns.jar.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.ds_1.4.200.v20131126-2331.jar.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Santarem.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\bckgzm.exe.mui.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Thule.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Oral.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Managua.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.properties.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.ja_5.5.0.165303.jar.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\vlc.mo.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\am.pak.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Gambier.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Winamac.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+8.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Niue.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base.nl_ja_4.4.0.v20140623020002.jar.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_ja.jar.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler.jar.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-api-caching.jar.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\kn.pak.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfont.properties.ja.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-loaders.jar.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Bucharest.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libidummy_plugin.dll.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-BR.pak.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\dragHandle.png.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.dll.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IO.Log.Resources.dll.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Oslo.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kamchatka.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationBuildTasks.resources.dll.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationProvider.resources.dll.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\appletrailers.luac.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novosibirsk.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\mc.jar.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macHandle.png.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\JoinConvert.m4v.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Godthab.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_ja.jar.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiBold.ttf.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL.tmp	cc5604c8e91d439c459871963fbadd50N.exe
File created	C:\Program Files\DVD Maker\fr-FR\WMM2CLIP.dll.mui.tmp	cc5604c8e91d439c459871963fbadd50N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cc5604c8e91d439c459871963fbadd50N.exe

C:\Users\Admin\AppData\Local\Temp\cc5604c8e91d439c459871963fbadd50N.exe
"C:\Users\Admin\AppData\Local\Temp\cc5604c8e91d439c459871963fbadd50N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

Filesize
46KB

MD5
a4db6f638ce0eea3955d1c6a976d83ec

SHA1
973f223c8c58fa7495aee2e858a2682949137f19

SHA256
ca5dbfa7ca48c54a84ace9395d6ab415145a3df56b211f235802bfddd4e23d7a

SHA512
a92341f0a9080d79b643c1641ef0441f0a4ba932386b1a90399700de6125eadbcbd9534f3b1e6db5edbcb863f1bfd370818d967cc3212f36f5c59a0dedd675d0

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
55KB

MD5
08573feef335acc5ce43687c1fb15b21

SHA1
ae7ddf8b0f1851bbdf6ea4e8c975030a195b8598

SHA256
85ffe12f4e9942773fb554e50aace008da046192d003e2cd3a374899067c5ef5

SHA512
a6afad1f563e34d4f961f86e9daf6afbf33f5ced82441b03e60e5499beb1ec281c3283e1527678d0bc40c6d8a6d8c6838415860ab901bf8fbb94383a6ef998d2

Download Submit