e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45

Analysis

max time kernel
150s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 04:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
Size

62KB
MD5

5f9a0b56c867d6d824cd89d5c52dd91b
SHA1

95c056413bd056db634beb3a1e3e1861d231550f
SHA256

e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45
SHA512

d6dd225dd463ec5dd592380db33aae0077cccbd705a4397a013ec5a15b3c3321d37a9aeaf2084271fb761379f223f807cde914e13ccc7f8ca32f3ddf3c795084
SSDEEP

768:W7BlphA7dASbS7EXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKeU:W7ZhA7dAvGpG8nz4t4t

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3747) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\vimeo.luac.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\Welcome.html.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Mozilla Firefox\fonts\TwemojiMozilla.ttf.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IO.Log.Resources.dll.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_hevc_plugin.dll.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist_jstree.xml.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext-disable.png.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vulkan-1.dll.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\ui.js.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_av1_plugin.dll.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\38.png.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\4.png.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sampler.jar.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libnormvol_plugin.dll.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\weather.css.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prcr.x3d.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActions.exsd.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-visual.jar.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\slideShow.css.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\hxds.dll.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Karachi.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaribsub_plugin.dll.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Internet Explorer\JSProfilerCore.dll.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActionExceptionHandlers.exsd.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwasapi_plugin.dll.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\clock.css.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwritash.dat.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-options.xml.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\hxdsui.dll.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresslm.dat.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_specialocc_Thumbnail.bmp.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Rankin_Inlet.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Windows Mail\wabimp.dll.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\js\main.js.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\bg_sidebar.png.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-heapwalker.xml.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_zh_4.4.0.v20140623020002.jar.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_zh_CN.jar.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Windows NT\TableTextService\it-IT\TableTextService.dll.mui.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Azores.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_zh_4.4.0.v20140623020002.jar.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Montreal.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\mip.exe.mui.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiler.xml.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\El_Salvador.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Novosibirsk.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Pago_Pago.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgzm.exe.mui.tmp	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe

C:\Users\Admin\AppData\Local\Temp\e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe
"C:\Users\Admin\AppData\Local\Temp\e1c4659bceb8ae2321a76c14abca4109e5581b41bf5d30c01ee81d9ef89c6c45.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp

Filesize
62KB

MD5
00712ea3ca232dd8963f1768626fa53c

SHA1
e4d7ddf907b5fa0d37a0b455a1328737bcdc9aba

SHA256
d2bc57995ebcd3737a26dd4046bf4c95fa00b39e8876078235599ee665076539

SHA512
2235a70b9ab89ffc9b20cc898a7818e954abf575f7dc1470a8e37a3c8d859abd70e611d966f61348ff8f48882fd446165f3cc9acf4c4062c0c6a91539115ce8e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
71KB

MD5
29b4e4e585290d77d2866f79659acc6f

SHA1
a484d2fdc5ad52a98b069dc255eb3b5fb86ee076

SHA256
e8bc6a892b325af441d034a5be2e90b059d1d557b21efe654150caf97cd17506

SHA512
ad00bce430a75eb04d53cfa40a12ec3c3d5cdfa5df848dd1f165015c1fe9267a8829367a488c4b5230176b72c668be61513fc1dc1518f220b3728f8eb2edd37a

Download Submit