fdf230fe674af1b3704272e98bea3c824ea6f93bf2bfbc7e957b76b3e8e4df44

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e1bc7daf42bc76ced16fe6cac9945d90N.exe
Size

93KB
MD5

e1bc7daf42bc76ced16fe6cac9945d90
SHA1

b30f5ac1d769ecb2f8e6d027fe05d1a97bf5dccd
SHA256

fdf230fe674af1b3704272e98bea3c824ea6f93bf2bfbc7e957b76b3e8e4df44
SHA512

662c5fb4e2445e87ca267ef8b1771c9b750f11f95699431332b21103b93e97d70c0eb908723a7589a3bd3119c99fcce71e749e10ca58ce24a52b9d90904b0df4
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBKggH:69WpQE0zxgH

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3147) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Cairo.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_zh_4.4.0.v20140623020002.jar.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwritash.dat.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\scene_button_style_default_Thumbnail.bmp.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Scoresbysund.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.RunTime.Serialization.Resources.dll.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\rtscom.dll.mui.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcf.dll.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property_1.4.200.v20140214-0004.jar.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Taipei.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jawt.h.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_ja_4.4.0.v20140623020002.jar.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Java\jre7\lib\plugin.jar.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_pt_BR.properties.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\de-DE\PurblePlace.exe.mui.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861261279.profile.gz.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationTypes.resources.dll.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qatar.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kathmandu.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsBase.resources.dll.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_zh_CN.jar.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-api.xml.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\imjplm.dll.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tabskb.dll.mui.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pontianak.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_zh_CN.jar.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\FormatResume.ocx.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Java\jre7\bin\net.dll.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Casablanca.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Mozilla Firefox\mozavcodec.dll.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\vlc.mo.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mip.exe.mui.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\CompleteRemove.mpeg.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Internet Explorer\en-US\networkinspection.dll.mui.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-environment-l1-1-0.dll.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Monaco.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-options.jar.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Malta.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ie\LC_MESSAGES\vlc.mo.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IPSEventLogMsg.dll.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Java\jre7\bin\javafx-iio.dll.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Entity.Resources.dll.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\vlc.mo.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe.tmp	e1bc7daf42bc76ced16fe6cac9945d90N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e1bc7daf42bc76ced16fe6cac9945d90N.exe

C:\Users\Admin\AppData\Local\Temp\e1bc7daf42bc76ced16fe6cac9945d90N.exe
"C:\Users\Admin\AppData\Local\Temp\e1bc7daf42bc76ced16fe6cac9945d90N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini.tmp

Filesize
93KB

MD5
4cc79983d5efebebc86b8f4caf397c9b

SHA1
d7d80da95540ca8d2c6aac5e4017eb27668802df

SHA256
e6c7102f4dc3104965e85868fa226af15bb45e961b1ded88876eefc1cbf00f52

SHA512
18aedfe149ba147051f194d7b7c4d0cfdaffd0942145e450d28bd5104e58c0ca369329f57c6c275c45ae64541f5ff7b98336b7d4093efafbb989d0080027073b

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
102KB

MD5
00e5b0ec03bdc0f474fe0d6388469790

SHA1
3e94893c68d880b53f35f280df0138f8da15bf9d

SHA256
15d5e676d463923800a7d8da3f8f7ae01f925242dbbdea89dfb0c826ac59ee58

SHA512
549b9c2102398e67c79f3ee7120eda115ec3b47ca7e2f59516d4a46e4972f3cf498ba9be9db2442fe50bb31de84a1005534d5e714615892aad2db8f72c026bf8

Download Submit