426cf7f68ec7e78f4b2a559ac63471425cdc183de1fe9e92138d16d43f685d29

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 12:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
Size

54KB
MD5

ee5bcbc24d43dc916ec79e5bb648dbb0
SHA1

fff0082f7e48eda334df1a4ad01ca84efc974416
SHA256

426cf7f68ec7e78f4b2a559ac63471425cdc183de1fe9e92138d16d43f685d29
SHA512

b5cc33b4a8c5073c1e8e1981c4629c6545d8c97eeab6a0a337e950fbba92b530cc09e435b5f132141541fc6cc8046e40f22d8f520f5a5b8d660bdaf86ea77d4d
SSDEEP

768:W7BlphA7dASbSjJJ1EXBwzEXBwdcMcwBcCBcw/tio/tiaj7:W7ZhA7dABJJ7TTQoQE

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3413) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\vlc.mo.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ms.pak.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Tripoli.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Panama.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ja.pak.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-threaddump.xml.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Manila.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Campo_Grande.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net.nl_ja_4.4.0.v20140623020002.jar.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\charsets.jar.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_sse2_plugin.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-explorer.jar.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Microsoft Office\Office14\BCSLaunch.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_ja_4.4.0.v20140623020002.jar.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jre7\COPYRIGHT.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\MET.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Microsoft Games\Chess\es-ES\Chess.exe.mui.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\desktop.ini.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Microsoft Office\Office14\AUTHZAX.DLL.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Microsoft Office\Office14\VISSHE.DLL.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Louisville.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_ja.jar.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_10_p010_plugin.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Kerguelen.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.lnk.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsBase.resources.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\vlc.mo.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-api-visual.xml_hidden.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Printing.resources.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libfluidsynth_plugin.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_ja.jar.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+10.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Selectors.Resources.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdav1d_plugin.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Shanghai.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jre7\bin\unpack200.exe.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Rio_Gallegos.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.Design.resources.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Managua.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.zh_CN_5.5.0.165303.jar.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\jaccess.jar.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.properties.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l1-2-0.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libsmb_plugin.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\DVD Maker\de-DE\WMM2CLIP.dll.mui.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.descriptorProvider.exsd.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Paramaribo.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Shanghai.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\Welcome.html.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.RSA.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Internet Explorer\perfcore.dll.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.SF.tmp	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee5bcbc24d43dc916ec79e5bb648dbb0N.exe

C:\Users\Admin\AppData\Local\Temp\ee5bcbc24d43dc916ec79e5bb648dbb0N.exe
"C:\Users\Admin\AppData\Local\Temp\ee5bcbc24d43dc916ec79e5bb648dbb0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini.tmp

Filesize
54KB

MD5
13ebbace4eb99fa39e86486eda75705e

SHA1
6746b00a19092874d6dd8069b4f6c1d18056789e

SHA256
99a8c67a09ffcb3b4106064d481e1092b09ddd169d5e74354ad97d3b9448c83d

SHA512
550655b2c407e3169b1da090848865240898e3a4443f181ae28244c6674b2443e3a1c3e92bf1504df3d47e42c66a9b9f39de091f7c0ed8500c8aeed0a04298f6

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
63KB

MD5
d89d4edd36a72af27424bf33cc700f30

SHA1
51f4a5b48acb0ad43d55ac4427e3663aab0dd058

SHA256
5d0fbb0117770ed37059a96169be8a5c38138a8f8fd379ffaf0c72043886dd69

SHA512
652202f75a046d034253ebe782aec629cd10af55f4c46b16bde83766edc0b0b6157f6b5c73eefb8ecbd64299685915a1a5fc3f567f5cdbd1bc459e16574eaa07

Download Submit