8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 09:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
Size

59KB
MD5

ba46c4b98b950c5ca77b8ca027a4c960
SHA1

d0faf3c6b5b0b3939adf8bdb678e950907bdd13a
SHA256

8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205
SHA512

0ee1da0163acf88dceb41786434976a07b275431822645ed8a36dec9d7b3bab21ebaabe6c98ed44766dcc22c33d1c124a722c784186f01d6a2d6af70252831bd
SSDEEP

1536:W7ZrpApojswv0EhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsoN:6rWpcsHEhLfyBtPf50FWkFpPDze/qFsk

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3213) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodicon.gif.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Rothera.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\it-IT\Minesweeper.exe.mui.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\ir.idl.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs-nio2.jar.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_zh_CN.jar.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Caracas.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\config.ini.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\com.jrockit.mc.console.ui.notification_contexts.xml.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\contbig.gif.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_ja.jar.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_zh_CN.jar.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jre7\bin\management.dll.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Johannesburg.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_ja.jar.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_zh_CN.jar.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\FlickLearningWizard.exe.mui.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_SelectionSubpicture.png.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_ja_4.4.0.v20140623020002.jar.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Mozilla Firefox\ipcclientcerts.dll.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\extensions\VLSub.luac.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Macau.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_ja_4.4.0.v20140623020002.jar.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Management.Instrumentation.Resources.dll.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\DVD Maker\bod_r.TTF.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_zh_CN.jar.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Boise.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdca_plugin.dll.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\tipresx.dll.mui.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_ja_4.4.0.v20140623020002.jar.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Monterrey.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\New_Salem.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Monticello.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.DataSetExtensions.Resources.dll.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\dumpmeta.luac.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_zh_4.4.0.v20140623020002.jar.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-core-kit.xml.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Swift_Current.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.RunTime.Serialization.Resources.dll.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-plaf.jar.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-ui.xml.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\sd\icecast.luac.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jre7\lib\security\cacerts.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libau_plugin.dll.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_zh_4.4.0.v20140623020002.jar.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jre7\lib\ext\zipfs.jar.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Xml.Linq.Resources.dll.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoBeta.png.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-execution.xml_hidden.tmp	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe

C:\Users\Admin\AppData\Local\Temp\8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe
"C:\Users\Admin\AppData\Local\Temp\8c921aff3e42d25c2a030f70b8cb7c6e42eb46cb61930550463ebd69efab7205N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4177215427-74451935-3209572229-1000\desktop.ini.tmp

Filesize
59KB

MD5
365295c7640ee912ee663af7e3555f83

SHA1
bdb3bf35b330cbc15e3bd376a05c7f4d3026bce5

SHA256
305c58ee5cbaddfc56a5cd60afe229e453eea9f751c5903227a0a69413d6fa43

SHA512
a1eca2967b6f7671a54ef02967cd9fa8de5f83c5e5c0882b99902b58f4ebb448ab2874463d83fa6937448a2089b3ee7733486cd62f161cc2873194a2beed4b67

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
68KB

MD5
60cc5d5c2eeec3465a1456f1ab8a21c9

SHA1
3d1f31e323d12caa5d216a2881ef9c736ab114e0

SHA256
ac3da8cdb51361b0c01f62f992c3409d95d3c76c38f977acd77c023f0012923a

SHA512
52f0246028c4e23d8820ce6c1bbccce695935a9aeb40918cfb346061cadcd2aef0db9bae5c9f78eabbf0e328d2c2e3956c25aa26c926ac3200ff3d3d50247ac2

Download Submit