5c299b468fc6f47529cf0ff88501963a7925e3e0dcd49a8c5b023b7cc072992a

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 10:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce22bd076c4ecc83d97cf6709e58ac00N.exe
Size

69KB
MD5

ce22bd076c4ecc83d97cf6709e58ac00
SHA1

03bf9b0e51021fb3ea2615b1a337551e36bd828a
SHA256

5c299b468fc6f47529cf0ff88501963a7925e3e0dcd49a8c5b023b7cc072992a
SHA512

6f1a9fc9cb1b5f48b29ceccec7b9e243552e3e4314aecd0304939ba1fb17fd4db0b6f4a17b4147e2679612a00af9191ce75d5f7aa52200fca7f9869f41ef9c3c
SSDEEP

768:W7Blp2sspARFbhJpupZ5pZ4+fTgTvlK1lK6RZR+8/8gClurYClurUpOpE:W7Z2sspApkZrZ4+fU7lK1lKT8/8s

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3261) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Monrovia.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_ja_4.4.0.v20140623020002.jar.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_zh_CN.jar.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_ja.jar.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Canary.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Porto_Velho.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\CloseTrace.mid.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\zipfs.jar.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf_3.4.0.v20140827-1444.jar.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Mozilla Firefox\application.ini.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cancun.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sa.jar.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glib-lite.dll.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Games\Hearts\de-DE\Hearts.exe.mui.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvmstat.xml.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_zh_4.4.0.v20140623020002.jar.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_basestyle.css.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-progress.xml.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Guadalcanal.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nb.pak.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyrun.jar.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Denver.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipTsf.dll.mui.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\derby_common.bat.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di.extensions_0.12.0.v20140417-2033.jar.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libcaf_plugin.dll.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ceuta.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\CST6.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh001.htm.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\BHOINTL.DLL.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tunis.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\MANIFEST.MF.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_ja_4.4.0.v20140623020002.jar.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_ja.jar.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\DVD Maker\offset.ax.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfr.dll.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Louisville.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Edmonton.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ja_5.5.0.165303.jar.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kolkata.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler.nl_ja_4.4.0.v20140623020002.jar.tmp	ce22bd076c4ecc83d97cf6709e58ac00N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ce22bd076c4ecc83d97cf6709e58ac00N.exe

C:\Users\Admin\AppData\Local\Temp\ce22bd076c4ecc83d97cf6709e58ac00N.exe
"C:\Users\Admin\AppData\Local\Temp\ce22bd076c4ecc83d97cf6709e58ac00N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

Filesize
70KB

MD5
0dec2f06b2e927be4f1ba4ec9ea5135d

SHA1
6a47c7c370dc5d4a367088673b5d75b40a3abd82

SHA256
66cd7ba788e537df5c27441de9171b5c7f3c8f2ee7d795ae8dce3f29a0032ce3

SHA512
ab614760062a1d7ce26a99b2485f489f9fa92ac1591e9cf427a38649c6e8abc585cefea0d7dc1d8ed0fd57409f60b34ac87954210419573fe73af4b28d4eadd0

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
78KB

MD5
804415865177c752bd59ee24f63cb7f6

SHA1
190f30afbd9ba43f5c13fa0718801b5bf67e48c8

SHA256
62cd19dbcbac7b0440f38ae9da068787c5d78185d60f0d0fe321fab73727e8d9

SHA512
bbe744fc0247abff3ceeb253806c18268e336d3deb5dbac22a97a0783b1c119ec8a28c38ac037e3d41264cfb6138c7247bb767b207aa5d8518caac08688acacc

Download Submit