4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392

Analysis

max time kernel
149s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 21:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
Size

91KB
MD5

0cf873538df1fe5f5075105c3b02729b
SHA1

db8a49069fbd76b46daf5c54c4b6123540014562
SHA256

4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392
SHA512

ca2f5b2da9b11a4f629395325c53eb4aeb3e5e5c7b91612ff246b1b9e67b450da0291feddee99bf8454b0c1c162f44768af2f4b2b43db41bdc24d45318c8c535
SSDEEP

1536:W7Z2sspApGg7bobSM+t58qKcAK+j4nI4VfNgZ11PED4gJQeAAUZa0EzOMy:62ssWpGgrM+t58qKcAK+j4n7ByeFUF

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3455) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libwingdi_plugin.dll.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\settings.css.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-oql.xml.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_MCELogo_mousedown.png.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Marquesas.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_ja.jar.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipBand.dll.mui.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\tzmappings.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\DVD Maker\WMM2CLIP.dll.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tegucigalpa.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.resources_3.9.1.v20140825-1431.jar.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-cli.jar.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Guam.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-3.png.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\es-ES\MSTTSLoc.dll.mui.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-last-quarter.png.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiling.jar.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Warsaw.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Fakaofo.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libes_plugin.dll.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Windows Media Player\es-ES\mpvis.dll.mui.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ja_JP.jar.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.RSA.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Internet Explorer\en-US\iedvtool.dll.mui.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dcpr.dll.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_es.properties.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Sydney.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\RSSFeeds.css.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-last-quarter_partly-cloudy.png.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-windows.xml.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Microsoft Games\FreeCell\it-IT\FreeCell.exe.mui.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core_ja.jar.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jre7\lib\zi\EET.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jre7\lib\zi\EST.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_SelectionSubpicture.png.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\vlc.mo.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-today.png.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\RSSFeeds.js.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.properties.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.RSA.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcfr.dll.mui.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+5.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\tools.jar.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_zh_CN.jar.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Selectors.Resources.dll.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Windows Journal\de-DE\Journal.exe.mui.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Windows Mail\ja-JP\msoeres.dll.mui.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
File created	C:\Program Files\Windows Media Player\fr-FR\mpvis.dll.mui.tmp	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe

C:\Users\Admin\AppData\Local\Temp\4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe
"C:\Users\Admin\AppData\Local\Temp\4eee14485515d5919356395f35571ec3612fc19149e1ff1bad7023197f7b3392.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp

Filesize
91KB

MD5
68289cb7ac990005d0e32d7925b27c97

SHA1
166e1beab4ce7263b554d671a528f08b0dd40363

SHA256
d3f5ee9417ed39448265e864e46032f6d6237848b7efc158077bea2876d56271

SHA512
53e90681d22429776365b025c01c9ce63157ca6b2c698d53e1265d2742e6da1b8705cefb7543134296c61e75c06a481d4549affa1d34b40af081110ad37107f6

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
100KB

MD5
5e63f96d56914867a2f842cb763800bd

SHA1
874e2f1a009f1f8429129baf511831264af7e016

SHA256
4af43d4edd6c85ece237ec161553fa790520146b5c11ac6634e75ed8ce4064b2

SHA512
9c99213361b64619f0a8f37a31a27dab1e40ee50a6e1c8b9ecf8941b6930ddace113a700d7ce6a5557c14cd655f64253386517c245e9b4c0aae7e1f0cf9dd9d0

Download Submit