4cdc72a5b428940259beb9f39d47abacff7d429be59bca48d5ecf169d142644e

Analysis

max time kernel
107s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 01:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
Size

34KB
MD5

bc33fbb5ff37ca949354e7f3bb2c9df0
SHA1

02e5c4d9489d7b7432e7d665303a156ff55eb2bf
SHA256

4cdc72a5b428940259beb9f39d47abacff7d429be59bca48d5ecf169d142644e
SHA512

cb9ab67e4d2485f8b9359739adee932903e8e7675866508cbf0c0f9633ccc33471740a06fc5c5eaf959e6958c252097bfd8d3f17eaa7bf05ce321675b456b4d3
SSDEEP

192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vB7m/FJHo7m/FJHhpqW7U7OKpM:yBs7Br5xjL8AgA71FbhvszwLpM

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3098) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.dll.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\vlc.mo.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Srednekolymsk.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\DVD Maker\fr-FR\DVDMaker.exe.mui.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nb.pak.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Phoenix.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-options.xml.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_ja.jar.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Efate.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Microsoft Games\Hearts\en-US\Hearts.exe.mui.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Internet Explorer\en-US\F12Resources.dll.mui.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_ja_4.4.0.v20140623020002.jar.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\DumontDUrville.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\UTC.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tabskb.dll.mui.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\vlc.mo.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet.jsp_2.2.0.v201112011158.jar.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_zh_CN.jar.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Ho_Chi_Minh.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.bat.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qyzylorda.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Anadyr.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\local_policy.jar.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\file_obj.gif.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationCore.resources.dll.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_ButtonGraphic.png.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\msvcr100.dll.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Hobart.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Honolulu.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_elf.dll.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_zh_4.4.0.v20140623020002.jar.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsBase.resources.dll.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.pb_2.3.5.v201404071733.jar.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\vlc.mo.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogo.png.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\currency.data.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_zh_CN.jar.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Mozilla Firefox\defaultagent_localized.ini.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\vlc.mo.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_ButtonGraphic.png.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Thimphu.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.xml.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClientsideProviders.resources.dll.tmp	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bc33fbb5ff37ca949354e7f3bb2c9df0N.exe

C:\Users\Admin\AppData\Local\Temp\bc33fbb5ff37ca949354e7f3bb2c9df0N.exe
"C:\Users\Admin\AppData\Local\Temp\bc33fbb5ff37ca949354e7f3bb2c9df0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini.tmp

Filesize
34KB

MD5
e3374b28eece24d789f34e98becebf11

SHA1
da29f32abea949c279c4a0852f31616f39dd5744

SHA256
4ae77373f47d54939596962e05a7403fe83c22c71f8d114022f23ec94f33550c

SHA512
c2bfc163d96716b6a39727d849a1726abed39e644412319103a403e1ee0af5cb98406a33fd0bdb840f70a7aca85da7a7adfae579255a930009e5cb33aca0e171

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
43KB

MD5
75f180da3f00aee37ea4e2e604b34690

SHA1
202b30acb97fb03fbe21e65fc2a04c32736f3999

SHA256
64b8549034be5867db60aaf6f6cd6ea1bd7823858a3f403f9a904df62e282a6d

SHA512
1d94a7ad78984b2512f57dbaac9ac0397fd713c1d85098d5fe7fb89ce00226d2aca4450aa043dd3a31a5cfdaa1af2a2ba584faafadd6947bd8899654977f5214

Download Submit
memory/2168-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2168-74-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download