d2c4973d516455b4dbc1e065edd895f1640bfde47e3b7ce0b0336e3afc5fc73b

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/09/2024, 14:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8cc971a3483ed8c96908a15be67b72c0N.exe
Size

81KB
MD5

8cc971a3483ed8c96908a15be67b72c0
SHA1

cba393a8ecc18a2762a4ac9d897454945838fbf5
SHA256

d2c4973d516455b4dbc1e065edd895f1640bfde47e3b7ce0b0336e3afc5fc73b
SHA512

7a67a517efccfebd35ed2dfc031ced8317e41c5b3473fda53175feb612cfa4b74b5fcc24e1192ea17b9a0485fe0311a35cc9dfbc2c14464dfb8cf147d8e60ef3
SSDEEP

768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcC+3mC+3meDAfABJ6fABJwEXBwzEs:/7ZQpApze+eJfFpsJOfFpsJ5Dq

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3212) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Windhoek.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_ja_4.4.0.v20140623020002.jar.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightItalic.ttf.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Mozilla Firefox\updater.ini.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Java\jre7\lib\security\java.security.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\ShvlRes.dll.mui.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Mozilla Firefox\install.log.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libfaad_plugin.dll.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Monrovia.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\HST.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Internet Explorer\jsprofilerui.dll.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Curacao.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port_of_Spain.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_ja_4.4.0.v20140623020002.jar.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Center.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\vlc.mo.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_zh_4.4.0.v20140623020002.jar.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Rome.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Hobart.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.resources.dll.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs-nio2.xml.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\liboggspots_plugin.dll.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bangkok.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\bckgzm.exe.mui.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File B.txt.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_ja_4.4.0.v20140623020002.jar.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\UTC.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libbluray-awt-j2se-1.3.2.jar.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Internet Explorer\en-US\jsprofilerui.dll.mui.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Boa_Vista.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-outline.xml.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler.xml.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler.xml.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Broken_Hill.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationTypes.resources.dll.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsdl_image_plugin.dll.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libcc_plugin.dll.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-annotations-common.jar.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_plain_Thumbnail.bmp.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ko_KR.jar.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libadummy_plugin.dll.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui.tmp	8cc971a3483ed8c96908a15be67b72c0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8cc971a3483ed8c96908a15be67b72c0N.exe

C:\Users\Admin\AppData\Local\Temp\8cc971a3483ed8c96908a15be67b72c0N.exe
"C:\Users\Admin\AppData\Local\Temp\8cc971a3483ed8c96908a15be67b72c0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini.tmp

Filesize
81KB

MD5
d29fc3091d357c4e0cbce6092773c995

SHA1
713cc55cdd83723b61c31ad1ba73d7fb6c89ab41

SHA256
ae819fbf0b12678e99dafa14e6141751ee78358bd59294213a686d68c5c6e6a8

SHA512
230e94ee9714f59c543c99205c3184ad9594ccc322024892a3dee6722efb2acc613136bf713f06bb9de27155d37fe0c413bcf9c616e00d21121b0d1404ff6d8a

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
90KB

MD5
ff17f2ef8db9ce077713fa3d8be73b48

SHA1
ccc8a73b044c623917df9cf865e0c0fec62ccad1

SHA256
d601e7db60dbd5b9f93e6ba221c7ba51cbcbb67bbe9bed80fd9b7411fdce77c2

SHA512
8fa0f99958e236a7ca909b234bafc99d3384ce84bce729ea727b456836095c779e747b2e77487392044495598e314c766da0177a0a2d54f2c239304bdf368ec6

Download Submit
memory/2860-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2860-74-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download