bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49d

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 16:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
Size

44KB
MD5

cf1fb2905daff5fbe576a6f05af68540
SHA1

ba68999d98a81be6773e5eef062888d24e7260f9
SHA256

bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49d
SHA512

2b5aa7994c39263e79e38fe6c9a27b4f3061e00badc8b5301bd680178ea7fa19878146b3961187d173765882fc56249e669c480d1161e3528e2f236216f98a7d
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFZPsFhiXFhiozlAJdxilAJdxi:W7ZppApBULcfpHLcfpyDZPQqrF

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3218) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\eclipse.inf.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.el_2.2.0.v201303151357.jar.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-loaders.xml.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsvcdsub_plugin.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Paris.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Danmarkshavn.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.h.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Bougainville.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libqsv_plugin.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Mozilla Firefox\update-settings.ini.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Rangoon.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\SearchMount.vssx.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\access-bridge-64.jar.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Istanbul.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8PDT.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_zh_CN.jar.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\license.html.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiler.xml.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+12.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Christmas.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.ServiceModel.Resources.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIcon.png.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Lagos.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kathmandu.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Games\Hearts\Hearts.exe.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-outline.xml.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\toc.gif.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_ja_4.4.0.v20140623020002.jar.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpn.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Azores.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\send-email-16.png.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.nl_zh_4.4.0.v20140623020002.jar.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsBase.resources.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-visual.xml.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-heapdump.xml.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jre7\lib\tzmappings.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Games\Solitaire\en-US\Solitaire.exe.mui.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\micaut.dll.mui.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Yekaterinburg.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipBand.dll.mui.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\jvm.cfg.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.service.exsd.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Bishkek.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.ja_5.5.0.165303.jar.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgRes.dll.mui.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe

C:\Users\Admin\AppData\Local\Temp\bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
"C:\Users\Admin\AppData\Local\Temp\bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
44KB

MD5
000382a15de0f04ac93afb6c2724d7c8

SHA1
eba08be4feb7950bd59ccb49b8ca5d684b662271

SHA256
85bdbe3678b20fbc68f28f3ebc8a67dacdd92bb7096cd67b6dd30cbaa9d79cf4

SHA512
bbba6633ecc06bada9477d8b0a473d685fc7facd4a8e70be88fa6bf918f837c375ba99be442aff7367b60c62ccf8c2db86fdbf1b3c5ade66d75ae46cea1863c0

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
53KB

MD5
88655fde7a844e992401ccb446ccf319

SHA1
a5b6885199aadfe11cf653edb5d0eeca53d786ee

SHA256
1fb39b44d1167b04e9d913e1875260d472ac5b558045e086f78931138381d390

SHA512
845600b1b01414bb44642990e5d142ed1da660e4d503e111cad091ec9fabee71f9a7d3b077e612c1046fccf751c7d5fcdf414814449ea6d431452c0e70ff5fe8

Download Submit