4df305023a4653bacb2e2d7b2cd8034fa880231f4ede69c48f1c52d1ea1f4ff9

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 19:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ee8b818c5232e302e6f8f4fe79bd9c00N.exe
Size

103KB
MD5

ee8b818c5232e302e6f8f4fe79bd9c00
SHA1

76ca19c4c159a5e79cc4e0243fe71b219f9a01b3
SHA256

4df305023a4653bacb2e2d7b2cd8034fa880231f4ede69c48f1c52d1ea1f4ff9
SHA512

70fafed143040e25e5fdad60284b672f8e0962d914b82ee7905175ec909db398206409608f2aab2a7648c9df38b0a2c0fcebcbd0689c9076bd1f56e91bac49e8
SSDEEP

3072:9QWpze+eO888888888888888888888888888888888888888888888888888888F:Lpe+ekey

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2661) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\travel.png.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Halifax.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Algiers.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Maceio.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Macau.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-filesystems.xml.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpnr.dll.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Internet Explorer\en-US\F12Resources.dll.mui.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-settings.jar.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\London.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_ja.jar.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-io-ui.xml_hidden.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\bckgzm.exe.mui.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Broken_Hill.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.xml.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+10.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler.nl_zh_4.4.0.v20140623020002.jar.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.smil_1.0.0.v200806040011.jar.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Ust-Nera.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssv.dll.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sendopts.jar.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_CN.jar.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\meta-index.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-annotations-common.jar.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-core-kit.xml_hidden.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_ButtonGraphic.png.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Internet Explorer\Timeline_is.dll.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Kosrae.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-core-kit.xml.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\zipfs.jar.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_ja_4.4.0.v20140623020002.jar.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.commons.logging_1.1.1.v201101211721.jar.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector_1.0.200.v20131115-1210.jar.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-templates.jar.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jre7\lib\ext\sunec.jar.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Juan.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\EST.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\MST7.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\ir.idl.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security_1.2.0.v20130424-1801.jar.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jre7\bin\jaas_nt.dll.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vevay.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ko.properties.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-api.jar.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Nicosia.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-uisupport.jar.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\Java\jre7\bin\management.dll.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png.tmp	ee8b818c5232e302e6f8f4fe79bd9c00N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee8b818c5232e302e6f8f4fe79bd9c00N.exe

C:\Users\Admin\AppData\Local\Temp\ee8b818c5232e302e6f8f4fe79bd9c00N.exe
"C:\Users\Admin\AppData\Local\Temp\ee8b818c5232e302e6f8f4fe79bd9c00N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

Filesize
104KB

MD5
b2f958806f6087664d3390d3b5f29a35

SHA1
4110dfb58f032d5da09776e1b66e87983c9a0dab

SHA256
35f6b22a4b132a985ef5dd2209e21293cd37ae97c1572fd0196c06e3a31ba74c

SHA512
9fab85437275584c6fd50ad609d4884bef0d9746c1110732966376494a421baec079e0c7ed6f978b14977da59033ec8d65a33d6cbc0e26f54f8e666bdc252119

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
113KB

MD5
b39d35eaed262c016c98969e2f2091d7

SHA1
d95fc940624a5f95e0ac9f473a2dc8146925ce2d

SHA256
45cbc3c84c6378444cd92d968356ccf1f5f068e1888f2bcac99ba78f56f5e811

SHA512
47b3eead93adeb4ae223d3c03ef7b15aad2d3e701c4f4dece85e44c85f9e874979ec61a6670fc402951da4f00c88fa65a02841ea212c9bca7f86984138f91fb8

Download Submit
memory/2516-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2516-206-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download