ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07/08/2024, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
Size

41KB
MD5

f58a256778841a8a885f9f9798e796b9
SHA1

5e45c93b93f7b077c99fae802af5cb78e7cab974
SHA256

ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0
SHA512

8e155aad07050a359db64a9dbb761afb76fca93094f6623392aadcc8944d62d8a0b476ef94cb82ec929f494cb9ec0ba99d44a76bc806931c8d0e8fe35e5d94e9
SSDEEP

384:yBs7Br5xjL8AgA71FbhvPvD4Qfxd4QfxI3V:/7BlpQpARFbh3vzfxRfxI3V

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3682) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Chatham.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-convert-l1-1-0.dll.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\settings.css.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Center.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\ChkrRes.dll.mui.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libprefetch_plugin.dll.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\settings.html.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Windows.Presentation.resources.dll.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\common.luac.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgaussianblur_plugin.dll.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_zh_4.4.0.v20140623020002.jar.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\ChkrRes.dll.mui.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Windows Defender\MpCommu.dll.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_zh_CN.jar.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemuxdump_plugin.dll.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\21.png.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_m.png.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\settings.html.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\rtscom.dll.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Microsoft Games\More Games\fr-FR\MoreGames.dll.mui.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Mozilla Firefox\libGLESv2.dll.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libx26410b_plugin.dll.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\visualization\libglspectrum_plugin.dll.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_zh_4.4.0.v20140623020002.jar.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Pitcairn.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\RSSFeeds.html.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Grand_Turk.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ulaanbaatar.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Sofia.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.servlet_1.1.500.v20140318-1755.jar.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_zh_CN.jar.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libaudiobargraph_a_plugin.dll.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Windows NT\TableTextService\TableTextServiceYi.txt.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\scene_button_style_default_Thumbnail.bmp.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\am.pak.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.war.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\dt.jar.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\new-trigger-wiz.gif.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Bishkek.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\Chkr.dll.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Windows Mail\es-ES\WinMail.exe.mui.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Costa_Rica.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms_3.6.100.v20140422-1825.jar.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-applemenu.jar.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Microsoft Games\Chess\Chess.exe.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sm\LC_MESSAGES\vlc.mo.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\it.pak.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Enderbury.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\vlc.mo.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\settings.css.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\flight_recorder.png.tmp	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe

C:\Users\Admin\AppData\Local\Temp\ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe
"C:\Users\Admin\AppData\Local\Temp\ea3c9e277182c009c38f0ad64cb22bc6b6c0bf3abb8ee1255eaee7b4312774d0.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini.tmp

Filesize
41KB

MD5
b2dabdeea9a094a8bf45935fc2d210f7

SHA1
6f986681bcba35045496f5603cfcd09ac890a8c3

SHA256
be724258cf1ca5e83f8b27dba8787624bc72ab71bc605d3c3d20f71b45dc578e

SHA512
9c8b9e53a5d45d1494d1e5455620e7e0fd6422dcaadb6f6033176ebc308c53be2735c6ae333e07bf36cb391582f1ed38611287d5636ee0c5181b12f6833efc65

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
50KB

MD5
46df37be40f4f79fa4b476e30b636aef

SHA1
8d8a394177dbe5522a5d948321f1a66adfd01b5a

SHA256
efa4d561243ef9f37a08459bf16abc5a712d1fc246cc8bb3fc40b724e2f999df

SHA512
60be32011d06691aa90054322d0512720b244fb32409d90370611849b8df1e95845e5ff775ab649beed58b87bfc8f8a8309e2fcd5e1b369707942eaa17056f6b

Download Submit
memory/1008-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1008-640-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download