f9aaa20b3f0b73e075cd98a76695765178ac20176a16d2af3b925f5b10642f88

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14-08-2024 09:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5cce1bef056092bfb374fd94a62d3a80N.exe
Size

54KB
MD5

5cce1bef056092bfb374fd94a62d3a80
SHA1

1a56f002b5871cd5b2610d2ce8aa342fcba9c741
SHA256

f9aaa20b3f0b73e075cd98a76695765178ac20176a16d2af3b925f5b10642f88
SHA512

c0051ffa81f0bd202080df7f3c6016e3e46d761efabb73687735217f3188e1ee6759c4416be680a20ade875ebe40e47a076e3eeeb459dd1d86c045ebdb749138
SSDEEP

384:GBt7Br5xjL9AgA71FbhvuNBNKVkVYlIAItCCIntkntV/eazc5azc73A3Q:W7BlpppARFbhFAxC7ntkntV/fo4o5

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3284) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-api.xml.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-print.xml_hidden.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-core-kit.jar.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\InitializeComplete.midi.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\dragHandle.png.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\README.TXT.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\WET.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.util_1.0.500.v20130404-1337.jar.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Sao_Paulo.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\micaut.dll.mui.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_es.jar.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64_3.103.1.v20140903-1947.jar.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\npdeployJava1.dll.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Syowa.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-outline_ja.jar.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-io_ja.jar.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationFramework.resources.dll.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kiritimati.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.contenttype_3.4.200.v20140207-1251.jar.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-progress.xml.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\CircleSubpicture.png.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.access.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.zh_CN_5.5.0.165303.jar.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Brisbane.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdcp_plugin.dll.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_ja.jar.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.bat.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_ja_4.4.0.v20140623020002.jar.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_zh_CN.jar.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Mozilla Firefox\ucrtbase.dll.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\vlc.mo.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask_PAL.wmv.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\vlc.mo.tmp	5cce1bef056092bfb374fd94a62d3a80N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5cce1bef056092bfb374fd94a62d3a80N.exe

C:\Users\Admin\AppData\Local\Temp\5cce1bef056092bfb374fd94a62d3a80N.exe
"C:\Users\Admin\AppData\Local\Temp\5cce1bef056092bfb374fd94a62d3a80N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp

Filesize
54KB

MD5
b0e4f55db7288720c413b9a8d375d9b2

SHA1
c1c0709c08f7d5c27f34ca9b9e88338d8700b47f

SHA256
980839a70cad287533e3fbe137911150eab530f6bff6ce7173d12b54c73848e2

SHA512
1a304e78cfaec2ad3bb9f2186590d13e5cb3e8ac0a877731084d1ca680e3839cc298942838bc3fd025c213a2ce1d0118661a43eec3d671ac5e0af523b1954395

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
63KB

MD5
0b26824a93957e9215b0b289a9f70e00

SHA1
517283975560b0306c0e505918dd331d76296080

SHA256
e871b158f4d44c679a5a3c1104406656f930d5ae0c6968df4304f9fbb93f2376

SHA512
4b94ed42025a12029464421625a18c06dec7e56edd747757fc7d3648b6013bd1f13b50e2ec769c3064c12d2caf1f5d82e97dfa46cc6bc020bbcb6861425002e2

Download Submit