e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
Size

36KB
MD5

47124f15f23927d3a836526b0f846174
SHA1

e9752b8bd8b0e3e25259414d9c3dc4a28ebf3b57
SHA256

e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7
SHA512

d57db93a986d1f1d9665fc0ac25b7ca8f7b9cb735b5a5b387ee9d051dd76f6429e64a80df7de27f4575ae5e8f6986df8b7800ff218b817de8afebc34a42a75e4
SSDEEP

384:yBs7Br5xjL8AgA71FbhvsIzaApAyJO3ApAyJOGiT:/7BlpQpARFbhxztpAyJ5pAyJ8

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3733) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_glass.png.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Bahia.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgzm.exe.mui.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\DVD Maker\OmdBase.dll.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\jawt.lib.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-modules-appui.jar.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Java\jre7\lib\management\jmxremote.access.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\flyout.css.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jdwpTransport.h.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_ja_4.4.0.v20140623020002.jar.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-progress.xml.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Printing.resources.dll.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Windows Journal\fr-FR\jnwdui.dll.mui.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\DVD Maker\Shared\Parity.fx.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-output2.xml.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Java\jre7\bin\npt.dll.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Microsoft Games\Hearts\de-DE\Hearts.exe.mui.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\bckgzm.exe.mui.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_vc1_plugin.dll.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\delete_down.png.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_ja_4.4.0.v20140623020002.jar.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Java\jre7\bin\dcpr.dll.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_close_down.png.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\vlc.mo.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\shuffle_over.png.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh87.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.zh_CN_5.5.0.165303.jar.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\hprof-16.png.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler.jar.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunec.jar.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\org-openide-filesystems.jar.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\cpu.html.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576black.png.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Java\jre7\LICENSE.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\settings.css.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\profilerinterface.dll.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\jvm.lib.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_ja.jar.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Godthab.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\vlc.mo.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\VideoLAN\VLC\THANKS.txt.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Nicosia.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\GMT.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views_3.7.0.v20140408-0703.jar.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\ShvlRes.dll.mui.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libdummy_plugin.dll.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single.png.tmp	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe

C:\Users\Admin\AppData\Local\Temp\e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe
"C:\Users\Admin\AppData\Local\Temp\e62e469530b17d18c42d5513605aeeb0bc4ac1e59caa48b3b455fc5ddf7905c7.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
37KB

MD5
2332166b7874b7d5475ebc4394c0a10e

SHA1
12dc41d79ab0c98bc1271c4d17c914bef5141630

SHA256
6a03afde98ce49b0d15da828c5953450eb955f52b3fd33c8b3604c965c9315b1

SHA512
25a80784f9a8e337ee55930f22987704ad3462b1f7a68760c435172d0f849c1b6b2e1bf1ee41b649670f6adbf5c8455706a32a05416b3d703d8d1e0ab53d06f0

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
46KB

MD5
a2f54cefcfdc2e0508540db90db7dc0f

SHA1
f8081fbd9a7bbc6c8c7f1f7a97db818bd3146bb8

SHA256
7a1c23052177f8ece45b504aa339493321fc81f7b10653471ac9e9c651e53769

SHA512
e45d8c853c50f69fdf983a535c8a7ff47abcbff4433158d05181540de57ff914add59faf7246336d084c65e88a7c33c9028e216fc7c971f5a5184483de1de470

Download Submit
memory/2116-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2116-68-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download