cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 04:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
Size

65KB
MD5

65ec6472724f806f6c4500ea8aa36423
SHA1

f639131ddc8545c16ed9c8deb230f1d4b9345cc9
SHA256

cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a
SHA512

9af35f42a62e4466b6508ef90be499b913dcd6e27949641d9f1743ddd81cef5e8d9c3ae9d2869224c6253b5abc20cb7605de226042cc12d6ffba5dcb6e40551c
SSDEEP

1536:W7ZrpApojswv0EhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsoa:6rWpcsHEhLfyBtPf50FWkFpPDze/qFsn

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4676) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Mail.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Reader.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-pl.xrm-ms.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationFramework.resources.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ppd.xrm-ms.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-oob.xrm-ms.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ppd.xrm-ms.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ORGCHART.CHM.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.NonGeneric.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-2-0.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ko.pak.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OAuth.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationTypes.resources.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Claims.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.DirectoryServices.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ro.pak.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE2.POTX.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-80.png.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ppd.xrm-ms.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Xaml.resources.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsound.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ul-oob.xrm-ms.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Xaml.resources.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationProvider.resources.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.DLL.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-oob.xrm-ms.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.RegularExpressions.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXC.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.resources.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green Yellow.xml.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\dotnet\dotnet.exe.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClient.resources.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\123.0.6312.122.manifest.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\es\msipc.dll.mui.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\amazonredshiftodbc_sb64.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.ServicePoint.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrjit.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\DSMESSAGES.XML.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationCore.resources.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\InstallerMainShell.tlb.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_en.dub.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-oob.xrm-ms.tmp	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe

C:\Users\Admin\AppData\Local\Temp\cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe
"C:\Users\Admin\AppData\Local\Temp\cc883a126c81326b05ce1e166dbded4264805da6ecf3e7adc9bd815dc497ac9a.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3442511616-637977696-3186306149-1000\desktop.ini.tmp

Filesize
65KB

MD5
e35d4c24f29e5a6893a28a4519b0a72c

SHA1
9887a969ce4529ef73d8332335781961c4c5060d

SHA256
586600e91028ab1d421de77bf6fff4f1f05a23202f630a52626fffd5dbed5036

SHA512
05bd88ec7b082267c8b22d82a8238d237eb06c1a21113fdb6803b065760765dbe9c7dfaa38e2814688b01ab52d2597a04d7a083092aec7a7c9186024820b2de5

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
164KB

MD5
bf803ee030462556cdd53f9783d6442b

SHA1
eb542d84abf55a5eee8d0f4e6d21045698bac809

SHA256
ca2af515ddd6e2e35e62dbd11708d1f76d8208bafd1697bea8999e1c8751c6e2

SHA512
d9768c1d5396f0eb49eeb3c2f1d0881d11b8c1a1851b7baeb72070a7cf635ae81d5d5646570a90938c77d1a61f974111af8576c2d7bd0f808a59e55c6215846f

Download Submit