fb1a311d80e857d979f6baa5ef700c77a6995f9ac588e95448cd26ee7c2dba14

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 19:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e07a9bdcad76aa47084360f521f24330N.exe
Size

43KB
MD5

e07a9bdcad76aa47084360f521f24330
SHA1

f135148a4d58de82e005d47586679589138b50ad
SHA256

fb1a311d80e857d979f6baa5ef700c77a6995f9ac588e95448cd26ee7c2dba14
SHA512

6cb82d5b5d818d49eb520c57a9c9ba829b6719a1e7a6b94bb96e68dc5d86c1dd63c352290f266029b9801d0ea6b4f370b0b4027fa94059a36545eb4bd0045fdb
SSDEEP

384:GBt7Br5xjL9A7AgA71Fbhvnqj7jU7ubTAgpbuvx10AaIdKB7ubTAgpbuvx10AaIV:W7BlphA7pARFbhL801VvM801Vvv7cY3

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3270) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Mendoza.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Resources.dll.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tabskb.dll.mui.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse_1.1.200.v20140414-0825.jar.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-common.xml.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\invalid32x32.gif.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\classfile_constants.h.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata_2.2.0.v20131211-1531.jar.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_globalstyle.css.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\vlc.mo.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Cordoba.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.SF.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_mac.css.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Indianapolis.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsFormsIntegration.resources.dll.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Amman.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sampler.jar.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jre7\lib\jce.jar.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\LINEAR_RGB.pf.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core_visualvm.jar.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jre7\bin\server\Xusage.txt.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Montreal.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\SyncExit.htm.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\vlc.mo.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipTsf.dll.mui.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Internet Explorer\F12Resources.dll.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.access.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tongatapu.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_ButtonGraphic.png.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_ja.jar.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\02_frenchtv.luac.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.analysis_3.5.0.v20120725-1805.jar.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_zh_CN.jar.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_imem_plugin.dll.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-imageMask.png.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\j2pcsc.dll.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_zh_CN.jar.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\vlc.mo.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_realrtsp_plugin.dll.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guadalcanal.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libstereo_widen_plugin.dll.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_ja_4.4.0.v20140623020002.jar.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring.jar.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Noumea.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\7-Zip\Lang\be.txt.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.tmp	e07a9bdcad76aa47084360f521f24330N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port-au-Prince.tmp	e07a9bdcad76aa47084360f521f24330N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e07a9bdcad76aa47084360f521f24330N.exe

C:\Users\Admin\AppData\Local\Temp\e07a9bdcad76aa47084360f521f24330N.exe
"C:\Users\Admin\AppData\Local\Temp\e07a9bdcad76aa47084360f521f24330N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini.tmp

Filesize
43KB

MD5
697e17da9d17b485d5e96ce0f9389b0a

SHA1
61f92d86cdb03559354d4e1c0730b8eecb0e5ebf

SHA256
cbd9f5409f4aeea77898142dc52581b3f4d3be9095079fa6f7205338fb8d9268

SHA512
da8e14ba6882822ca7293d60e411119f996a633037c1de3be6e0a66a930a8d01fbeef5a5a1271ae6506726bd6f4d827e3531f6b8342b5dffac2021382193c360

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
52KB

MD5
75331bee8cbae7f656801282cebb1ddc

SHA1
f6b18ddc82e3136b928dd0410339b26786a9ac13

SHA256
4b8d1a08c74bd0ea5e01dac9dc37fc2e6777c2d5c3b988810f197bb935837ccd

SHA512
697da46144c70aed420260b0dd32d24ef7a712291aa47c5944cc57c1dce620789d9ac15dc64bd267a42a4abc84d4c42f87ded8409e693f0b80f2a3facde59a37

Download Submit