c1d9e8856fa973aa2ebfa6550f060b47670b67d47b022e98be4e35928cfaba8e

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 01:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c63b93ce2d71b9556362a0954d9a240N.exe
Size

47KB
MD5

0c63b93ce2d71b9556362a0954d9a240
SHA1

89f7a79a047f2e54c13d04f275daa2381f234b5a
SHA256

c1d9e8856fa973aa2ebfa6550f060b47670b67d47b022e98be4e35928cfaba8e
SHA512

9d6d81ef8dde9761d48a056a84d31137fc3ed4cbf04b869b39d08238f1daa9c943e683a0ce802cdace11b810fd8be4bbd33c33eeb360b597786668b76bcd8bf6
SSDEEP

384:GBt7Br5xjLvassAgA71FbhvgqHqMjL4jLS/3MMf/3MMy0U0czyKbNzzyKbN4HQG:W7Blp2sspARFbh5YSfffynfWK9WKWQG

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3340) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Wallis.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fiji.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help_3.6.0.v20130326-1254.jar.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Norfolk.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\es-ES\PurblePlace.exe.mui.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_zh_CN.jar.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_zh_CN.jar.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Printing.resources.dll.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Management.Instrumentation.Resources.dll.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libscte27_plugin.dll.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\eclipse.inf.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxml2.dll.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.attach_5.5.0.165303.jar.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt_0.12.100.v20140530-1436.jar.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Rio_Branco.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Thunder_Bay.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\keystore\libfile_keystore_plugin.dll.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf_1.1.0.v20140408-1354.jar.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_zh_CN.jar.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jre7\bin\installer.dll.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Dublin.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface_3.10.1.v20140813-1009.jar.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\liblogger_plugin.dll.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker_1.1.200.v20131119-0908.jar.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Canary.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\fr-FR\Minesweeper.exe.mui.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_zh_4.4.0.v20140623020002.jar.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Glace_Bay.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_zh_CN.jar.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libadummy_plugin.dll.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libvobsub_plugin.dll.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Xml.Linq.Resources.dll.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libnormvol_plugin.dll.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\VideoLAN\VLC\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-queries.jar.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Royale.dll.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Resolute.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\fontmanager.dll.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-plaf.xml.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\ffjcext.zip.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\vlc.mo.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActions.exsd.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Adelaide.tmp	0c63b93ce2d71b9556362a0954d9a240N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0c63b93ce2d71b9556362a0954d9a240N.exe

C:\Users\Admin\AppData\Local\Temp\0c63b93ce2d71b9556362a0954d9a240N.exe
"C:\Users\Admin\AppData\Local\Temp\0c63b93ce2d71b9556362a0954d9a240N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

Filesize
47KB

MD5
b00f1ab1a715242467cf57366e9c4815

SHA1
844fcd8a001455a7cd40092cff59b30c96da2824

SHA256
1e332d515cc853a9bf4c9689c225d06768d93997f580f7c815b3320706b70be7

SHA512
4ee4e0f77a53c360477335f96a91becbfee16fd56b4633014928dce24c068ab4c4cd5b6c9afa610cd3e3e2c5cfb954c85ce44ee11393b4cac718582bef9efa58

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
56KB

MD5
4129756a64e7af7beec5c17db5a29ec5

SHA1
84f4e16854971ee56def33ef8f5e2c1facc7908b

SHA256
3208523d6ef81499c6a3315f3eeb3117a36072677f4ecf6758c7e3663b2a5d63

SHA512
c8446a5300c8fa737273cb3a41b65c0c1603b42f9ca43381b4eb79e00e36da3ddd75ea2fea233749a9c3849e77b4399ec275eea3e3d047ce8e27fa7b83865c67

Download Submit