41b49ace7aeec2bdda8c4e44825c6bee4fb0947210eb8cd317c760f49c700002

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 00:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc3f880431522f049fcb5dbc5c316170N.exe
Size

50KB
MD5

cc3f880431522f049fcb5dbc5c316170
SHA1

d68db6eb56c8cdfc40b1d7fe4c93b0ada4ac2844
SHA256

41b49ace7aeec2bdda8c4e44825c6bee4fb0947210eb8cd317c760f49c700002
SHA512

bb3fdc719020cef88f357ac47d000386b5d622830e422f0d5d889259b3948163ae5ba38c46587fe00a5cd999e76c8bbc66d064b2bf8cbdd09e672ed13865f928
SSDEEP

768:W7BlphA7pARFbhL801VvM801Vvv7eniYfYx:W7ZhA7pApw03vR03vPQG

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3257) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.attributeTransformation.exsd.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\status.json.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui_5.5.0.165303.jar.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.ja_5.5.0.165303.jar.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore_2.10.1.v20140901-1043.jar.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Mozilla Firefox\mozwer.dll.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\layers.png.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\DVD Maker\WMM2CLIP.dll.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IO.Log.Resources.dll.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santarem.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\vlc.mo.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Internet Explorer\Timeline_is.dll.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-visual.xml.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jre7\lib\cmm\CIEXYZ.pf.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jre7\lib\zi\GMT.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jre7\bin\sunmscapi.dll.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-modules-appui.xml.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_SelectionSubpicture.png.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.ds_1.4.200.v20131126-2331.jar.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro_3.4.200.v20130326-1254.jar.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-plaf.jar.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Omsk.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libhttp_plugin.dll.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Srednekolymsk.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-attach.xml.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_fr.properties.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\vlc.mo.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port-au-Prince.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\London.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.jasper.glassfish_2.2.2.v201205150955.jar.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\liboggspots_plugin.dll.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_de.properties.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\ReachFramework.resources.dll.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.zh_CN_5.5.0.165303.jar.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-loaders.xml.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jre7\lib\cmm\GRAY.pf.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\MSTTSLoc.dll.mui.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jsse.jar.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunmscapi.jar.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Rangoon.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcfr.dll.mui.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belize.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-snaptracer.xml.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_ja.jar.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guayaquil.tmp	cc3f880431522f049fcb5dbc5c316170N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html.tmp	cc3f880431522f049fcb5dbc5c316170N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cc3f880431522f049fcb5dbc5c316170N.exe

C:\Users\Admin\AppData\Local\Temp\cc3f880431522f049fcb5dbc5c316170N.exe
"C:\Users\Admin\AppData\Local\Temp\cc3f880431522f049fcb5dbc5c316170N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini.tmp

Filesize
51KB

MD5
8cd5a7c50aebb9af62bad0cd33872f0e

SHA1
3190b713a7a6486acfb75acbffabaf42efdc18cb

SHA256
5dbaabb14d9ca5dc2f930fd1090f5a98687eaab289d6ae5251c55a726f2408d0

SHA512
2c28513afe5448f3618b35c3b2d761789e841efc3b29dedfbe4ac1e875577981e8c34c372aef914db60fdbd5894db756cf2fc818e8587fe98402b5bf7445e6f3

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
59KB

MD5
6d240b0d7cb291f0560ba1ee511cc042

SHA1
3e26baec86ebe8faf4fb1106abd09b30074fbf28

SHA256
982243dd416d1a1f133eaf359297075dd39d9cc5846a01c6d2f3fa084ad002ca

SHA512
71e4eeecd3d2e8ffdab4099c18a4b1728c22c97f7d86221472241fc1c0b3f775d00125bdecb19931b91a0b2d1d69f7b3b6898dd2b2a4e0ed91f64102c3a297ff

Download Submit