e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 13:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
Size

46KB
MD5

3dbcf7a2b6eb949832230377834c2363
SHA1

aa9b3bad5763e569bdbf4253a20259c6799272d4
SHA256

e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec
SHA512

578f3318755d09eba0028248e3ae34a555c087445cf0eb25afb2cbc72eb41e8eb7d8c459129372e0cf1e6635e801da20021190b925f9cad7d5fe4f017a675846
SSDEEP

768:/7BlpQpARFbhNIiJwsJwwnZEQoVeDQoVeJ:/7ZQpAplJwsJwwnlYN

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3742) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-api-caching.jar.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+12.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcfr.dll.mui.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Amsterdam.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Management.Instrumentation.Resources.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libbluescreen_plugin.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\VideoLAN\VLC\skins\skin.dtd.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\localizedSettings.css.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_ja.jar.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\vlc.mo.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Windows Media Player\WMPMediaSharing.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\La_Rioja.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface_3.10.1.v20140813-1009.jar.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\slideShow.css.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_ja.jar.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_streams.luac.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_it.jar.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunmscapi.jar.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vincennes.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_close_down.png.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.xml.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Microsoft Games\Chess\es-ES\Chess.exe.mui.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_WMC_LogoText.png.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-full_partly-cloudy.png.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_foggy.png.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-compat.xml_hidden.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Tegucigalpa.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libheadphone_channel_mixer_plugin.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libvdummy_plugin.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\settings.js.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.h.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Monterrey.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\graph_down.png.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui_5.5.0.165303.jar.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_ja.jar.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.lnk.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\icon.png.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcanvas_plugin.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\RSSFeeds.js.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-visual.jar.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_zh_CN.jar.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Microsoft Games\Solitaire\ja-JP\Solitaire.exe.mui.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libaiff_plugin.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsBase.resources.dll.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\jquery.jstree.js.tmp	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe

C:\Users\Admin\AppData\Local\Temp\e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe
"C:\Users\Admin\AppData\Local\Temp\e86d539a940bcf84264a2f2b39c9be0d48cc316989699b03e48c948dd7922aec.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
46KB

MD5
65b36d1e15222bc0f31dce72f4a83df5

SHA1
68c0bda6e2ad5964655ba82549cf6953ae346b8f

SHA256
6b8e10f9a531b9f17f58eef91270f2a3f251dd42488cd6700e210a9dba0cb546

SHA512
c22253d0548a2a0a2ba22ef8d749fdc451423122096f3a0e5dc5158c9918551ca68e0b32e8f06b68840986b109eb9dfeae9d07240d7da39d6b7e3396ed9299fd

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
55KB

MD5
eed83e42b569a339ecab9333787bc4e1

SHA1
cadb103f077c124e47f08e6c6d40c1d47f7074ed

SHA256
f20709e13ef8502274170af2de61e6626a27cf7b5fecf87d59ad66133d70f852

SHA512
e0defcf89d34cda112e87e2a31641b3fd0bb1be47a933e778f205a69928fb9fed427f80ff4b3f2d726b4b3b53470ffffb5e38fb9be04c69d4ad7161f02f4b658

Download Submit
memory/1720-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1720-70-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download