ac0ff3f5d0188af2a7fc6bc0ac2124b67d0ce01db9e31c6964ce54856a513344

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 23:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cdc99c56b3a6e86aa6be1287205c1a00N.exe
Size

70KB
MD5

cdc99c56b3a6e86aa6be1287205c1a00
SHA1

91687856f8ee021971121a2c4692c199037db96d
SHA256

ac0ff3f5d0188af2a7fc6bc0ac2124b67d0ce01db9e31c6964ce54856a513344
SHA512

c1ab0ef13487cc746e96df0e14e9b41242089cbf9a343cbd0c347d37673388fda6069e06e04377fff439dcac6044710339dac991da8bc25fbc6df839836e3abc
SSDEEP

768:W7Blp2sspARFbhJpupZ5pZ4+fTgTvlK1lK6RZR+8/8gClurYClurUpOpDd:W7Z2sspApkZrZ4+fU7lK1lKT8/8Z

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3170) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\he.txt.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jre7\bin\javafx-font.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Games\More Games\ja-JP\MoreGames.dll.mui.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\7-Zip\Lang\lt.txt.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsoundds.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macGrey.png.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\Shvl.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\v8_context_snapshot.bin.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\content-types.properties.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.RunTime.Serialization.Resources.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\vlc.mo.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_srt_plugin.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-loaders.xml.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcfr.dll.mui.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-templates.xml.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\deployJava1.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Winnipeg.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dili.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\eclipse.inf.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Games\Chess\Chess.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_SelectionSubpicture.png.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Pohnpei.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Mozilla Firefox\libGLESv2.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaraw_plugin.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.DataSetExtensions.Resources.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\VideoLAN\VLC\npvlc.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\WET.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.SF.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tabskb.dll.mui.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_zh_4.4.0.v20140623020002.jar.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_zh_CN.jar.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+9.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Mozilla Firefox\mozavutil.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.RSA.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Panama.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Microsoft Office\Office14\MSOHEV.DLL.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libshm_plugin.dll.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-ui.xml.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jre7\lib\calendars.properties.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santiago.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Singapore.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Sakhalin.tmp	cdc99c56b3a6e86aa6be1287205c1a00N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cdc99c56b3a6e86aa6be1287205c1a00N.exe

C:\Users\Admin\AppData\Local\Temp\cdc99c56b3a6e86aa6be1287205c1a00N.exe
"C:\Users\Admin\AppData\Local\Temp\cdc99c56b3a6e86aa6be1287205c1a00N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp

Filesize
70KB

MD5
7532638ecb5a45a0962fad74abec037f

SHA1
40dd8ad3e01f5ab943ddca67f620414c5c47a88e

SHA256
219830814f45cbba051c2102c7ddbef6751ee4f1eb45abda7743d9bb3b17593f

SHA512
5545ed30df9ddb748a36ab10e7fa0d09d9868405a4e75c565d2a254785ecd86c1936a56fd0521c55c41addf423e440173e3f6f13d6d304fea6facce66ac5fb6e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
79KB

MD5
79a7f72cc708da7168ebd978eed92d70

SHA1
1e407b273596afa1ef42d06d0e656c24df389c08

SHA256
1c95f909f6f8da29a2b58be61950caabee63357d789d274e57066dd3f96845e9

SHA512
86243ac387f0a1771835b36fe918aa263dc61bc42608e83a3897ec61ed27be854c38b906b2f58e43bb788305c2080373148fe988c0bbf4907c93e1ff59d75192

Download Submit