bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 07:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
Size

41KB
MD5

107fe5501e6442465221c08ac32ddfb0
SHA1

7b98b1acdefdd2b2e7044cefff8c65e969cebceb
SHA256

bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62
SHA512

455fa9209f0ab1c05d7251d41b71c7815409ab10f5d243df6da64653a39229ae565b6ef0cf926546201779d08ebcab48aa531da12a33be1bfa666d194bd06f23
SSDEEP

384:GBt7Br5xjL9A7AgA71FbhvnwR/s4Nkq81LOyq81LOUqKqeU3cLUA38gdcLUA38g0:W7BlphA7pARFbhM0Kkq81LOyq81LOk

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (452) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ja_JP.jar.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\v8_context_snapshot.bin.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\DVD Maker\ja-JP\OmdProject.dll.mui.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\203x8subpicture.png.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Internet Explorer\ieproxy.dll.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\optimization_guide_internal.dll.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\1047x576black.png.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Internet Explorer\en-US\iedvtool.dll.mui.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Internet Explorer\F12.dll.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkObj.dll.mui.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\DVD Maker\de-DE\WMM2CLIP.dll.mui.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\CircleSubpicture.png.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\manifest.json.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Internet Explorer\D3DCompiler_47.dll.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Internet Explorer\perfcore.dll.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\DenyPing.css.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\RELEASE-NOTES.html.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\1047x576black.png.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\DVD Maker\Shared\Filters.xml.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ShapeCollector.exe.mui.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bn.pak.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe

C:\Users\Admin\AppData\Local\Temp\bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
"C:\Users\Admin\AppData\Local\Temp\bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini.tmp

Filesize
41KB

MD5
ac78b66f4fa83077f8d8776b78f13f92

SHA1
454c066bee7389c077968b572c0e57e502fb2024

SHA256
405b8d1eb34991554452ccc5ced408c33c302ecd410a8ec9035c665ff0da2a79

SHA512
529b5d539f0ea26c649b8e524e440bfaab470a4ef1bc81e4604a2605f721f53d8a1299741f35315e7e362e3616b44b92c96901750dbd51e431e2e44a7313ce9b

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
50KB

MD5
5937a341a3ef2a92e67eb15da1e33a4a

SHA1
a815670c6ffbd91cdc3d51a5b34ad571c7e3a3af

SHA256
e0add96b0abfc96ff003fba7129bb3aa899d95f48978d6a196c5bcdb0c5aeff0

SHA512
52e412738e3ba277e32ba8dd56bdcc8b2e0fe4365c301700532697e2a75f34842cfc820167354b82ac95d00308cb8c2bdd858af4a1cedc63d614510e9c231eeb

Download Submit