cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a

Analysis

max time kernel
150s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 04:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
Size

65KB
MD5

65ec6472724f806f6c4500ea8aa36423
SHA1

f639131ddc8545c16ed9c8deb230f1d4b9345cc9
SHA256

cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a
SHA512

9af35f42a62e4466b6508ef90be499b913dcd6e27949641d9f1743ddd81cef5e8d9c3ae9d2869224c6253b5abc20cb7605de226042cc12d6ffba5dcb6e40551c
SSDEEP

1536:W7ZrpApojswv0EhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsoa:6rWpcsHEhLfyBtPf50FWkFpPDze/qFsn

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2881) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Boa_Vista.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jre7\lib\zi\CST6CDT.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bogota.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Davis.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lv.pak.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jre7\lib\classlist.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\ShvlRes.dll.mui.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\ReachFramework.resources.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Colombo.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\DVD Maker\fr-FR\DVDMaker.exe.mui.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\it.pak.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5EDT.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Halifax.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\CST6.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\shvlzm.exe.mui.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-background.png.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Internet Explorer\Timeline_is.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macHandle.png.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\MSTTSLoc.dll.mui.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.zh_CN_5.5.0.165303.jar.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Denver.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Paris.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_widescreen_Thumbnail.bmp.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Louisville.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_zh_CN.jar.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\MSTTSLoc.dll.mui.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4.ssl_1.0.0.v20140827-1444.jar.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.configuration_5.5.0.165303.jar.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Araguaina.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Jamaica.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ho_Chi_Minh.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Maldives.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fr.pak.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-attach.xml.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jre7\lib\jvm.hprof.txt.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Microsoft Office\Office14\MSOHEV.DLL.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\doclib.gif.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-text.xml.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Funafuti.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Design.Resources.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.ja_5.5.0.165303.jar.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe

C:\Users\Admin\AppData\Local\Temp\cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
"C:\Users\Admin\AppData\Local\Temp\cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
65KB

MD5
2c779fd8c7d55531fb2d06ee97662137

SHA1
c6438e41dfdceff0c2272a08a2c47cf2510ca65e

SHA256
eae577cb9f1ebba8b137ee4aaf30aaf81f8cbef455856eb6e4833ee3eb1b5794

SHA512
602c438792269376a20bdae990942bd02b173db234a186b18fb2c8ce77eeb25f36b496beb20496ada18794bd6148ed64007915023fce79ef847a2782c91a49ea

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
74KB

MD5
db648d5263761f711e113cc355789e72

SHA1
f53c5e7f206c78a14122a2ede66ede8d066e70d8

SHA256
c065f9c0d3bfea0417a00fe64ca64d7cf3463b3b2ef48521b7588e6663141f61

SHA512
619bc2bac35968e5ed56cdafb0c6f79a1f37729232c2c37bf37cfeb4ca13e37c916fddf54bb156a90e708e8356fa5743b322ca013b0c5e9551716801bd1c9e3f

Download Submit