e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68

Analysis

max time kernel
150s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 02:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
Size

111KB
MD5

86d97f04a6884d307cd2aff1c60db9c5
SHA1

0d41ccbe52fce45034b8216ae3d6fc7fe62667b7
SHA256

e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68
SHA512

c067f9b8ad1a4d5dab735ccf66c764fcf2e04cd721db03fd591b5014ae41f10733f6e000d62a073659511bfe537f19904498399e702f5db94ab6c2d77e5c41c1
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBo:PqFF2Ie+effyu

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3513) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_zh_4.4.0.v20140623020002.jar.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightItalic.ttf.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_ja_4.4.0.v20140623020002.jar.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\picturePuzzle.css.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\picturePuzzle.css.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-utilities.xml.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+1.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsdl_image_plugin.dll.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libntservice_plugin.dll.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemuxdump_plugin.dll.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libfingerprinter_plugin.dll.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\CoolType.dll.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\updater_zh_CN.jar.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IdentityModel.Selectors.Resources.dll.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_http_plugin.dll.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw48.jpg.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\new-trigger-wiz.gif.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Java\jre7\bin\npt.dll.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Microsoft Games\Hearts\en-US\Hearts.exe.mui.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Luna.dll.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_srt_plugin.dll.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\search_background.png.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fr.pak.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_ja.jar.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationBuildTasks.resources.dll.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_settings.png.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\22.png.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\jfluid-server-15.jar.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-heapwalker.xml.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hovd.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.Client.resources.dll.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libwebvtt_plugin.dll.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmpc_plugin.dll.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Windows Media Player\it-IT\wmpnssci.dll.mui.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\clock.css.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIconSubpictur.png.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyrun.jar.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-favorites.xml.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.png.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdmo_plugin.dll.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_dirac_plugin.dll.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_few-showers.png.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.zh_CN_5.5.0.165303.jar.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\VideoLAN\VLC\libvlccore.dll.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\slideShow.css.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\highlight.png.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Windows NT\Accessories\it-IT\wordpad.exe.mui.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\settings.html.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_ja_4.4.0.v20140623020002.jar.tmp	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe

C:\Users\Admin\AppData\Local\Temp\e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe
"C:\Users\Admin\AppData\Local\Temp\e8234ae9530e895553c1fb4ac4f0d2a5e39742e39e99555f9c650c35562e4f68.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
111KB

MD5
bcc7426c1587b00a4a07c17e6bdc253a

SHA1
f9fb74c6b37b6c4ca64c6f8ad89ecc744c52ea22

SHA256
af1c6b6730e879694d38bc4e452f4d7278b31352853d20a5339b25c66d24171d

SHA512
84d9215d46a959d2122c276d02c4bfbe46b61a80de90435addd82c6eea87113e65b2599997a436966873efa1fea9b09d7844bcd8048ae6e1dcca839e5ed7d7d4

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
120KB

MD5
73bb7338a30fb91bee1598235b90bd43

SHA1
064706b769ff15f7d41b44f46ab6cfc00e37368c

SHA256
f6045d7fa9e6dd8b9286122a4da81a8f24b409de10bc24ad5e0d8fafab8d0a15

SHA512
e047587e8b0bd42b6e16cfecb6ade070e40c4ffaca25a3b3f561c2b3d6069fdb2df729ed373053a874fb6a281562eebf860905796de3ad5205f1a3dcb61fb4c0

Download Submit