ecc8b1ae91074d2bcf617b04cb4629ca6a4b7fb7e4e5b4be7f8f1270cc7f2e83

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 23:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c2fc7acf8421befebb0e85f726d06d0N.exe
Size

42KB
MD5

0c2fc7acf8421befebb0e85f726d06d0
SHA1

3220bd968d3f15199dc1dd6bc1eb7cb3dabea4eb
SHA256

ecc8b1ae91074d2bcf617b04cb4629ca6a4b7fb7e4e5b4be7f8f1270cc7f2e83
SHA512

b3178b2659d5cac469b7e79c580b7ab4e7f9d4b264a14b1b4fa4e89f8d8d854f7678af35688ddb1d0058e4c3dc62ccb9883c1c57a3257665a7ecb9a7058f7326
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lsSl:W7ZhA7pApM21LOA1LOl6vSl

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3101) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\cs.pak.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Antigua.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qatar.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EET.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\dragHandle.png.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jre7\bin\rmiregistry.exe.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-output2.xml.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-4.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Miquelon.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dushanbe.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Ulaanbaatar.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Creston.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.descriptorProvider.exsd.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Rankin_Inlet.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\03_lastfm.luac.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Hermosillo.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rainy_River.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\bckgRes.dll.mui.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libhttp_plugin.dll.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.runtime_0.10.0.v201209301036.jar.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-environment-l1-1-0.dll.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf_3.4.0.v20140827-1444.jar.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_zh_4.4.0.v20140623020002.jar.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-utilities.xml.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_ja.jar.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaSansDemiBold.ttf.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Microsoft Office\Office14\MAPISHELL.DLL.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sawindbg.dll.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_zh_4.4.0.v20140623020002.jar.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_zh_CN.jar.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_ja.jar.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Juneau.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winClassicHandle.png.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core.jar.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\CloseConfirm.svgz.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-remote.jar.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\PST8PDT.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Bermuda.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.WorkflowServices.dll.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_ja.jar.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\vlc.mo.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Menominee.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	0c2fc7acf8421befebb0e85f726d06d0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0c2fc7acf8421befebb0e85f726d06d0N.exe

C:\Users\Admin\AppData\Local\Temp\0c2fc7acf8421befebb0e85f726d06d0N.exe
"C:\Users\Admin\AppData\Local\Temp\0c2fc7acf8421befebb0e85f726d06d0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
43KB

MD5
615deaaf61a2f337f5a7ef4789d8ee36

SHA1
ea03ab1d04e66e6a5b44ee237304ba8f79c85187

SHA256
198721326a443e7d51d8bbe337ed01034c4e7d212418646ff5b7cabd7c81355e

SHA512
1eca19ab52b2ee53681d1e9085ce1ecb9e3f834a591937dbca9df6bde30b51ea88b64ef9b2d3910fad744e7d08e27baa7f89ade34ffc0545059df532b2fe1866

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
52KB

MD5
f8b1ecee2275138ea56c4a4687bd518f

SHA1
ed9e05914d6186c6c472bd08281a7153b7a489ed

SHA256
490ab8bccd4c31991aa3d3020f0b3c03a60deebb8478a8f9dc7271a5d63429ee

SHA512
48b82a7d1115b7475546a84f1586d5ff75665bde742e931e78abc1606cf7d26f23f9480e50e9c4835c765db7645dd4d7fda506499e8cf86a481a157ecc7bcad6

Download Submit