00fe38b2f9e4b29eda5b2b9b19344ecbecad7c575579257201e2091b14b705a4

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-09-2024 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e4cd4575d842ed1822c15f32e8df2ef0N.exe
Size

84KB
MD5

e4cd4575d842ed1822c15f32e8df2ef0
SHA1

419c1688f8739fb99d45df5eb33daa242ffc9d2e
SHA256

00fe38b2f9e4b29eda5b2b9b19344ecbecad7c575579257201e2091b14b705a4
SHA512

d986e8781f749d82ff1d858c19cfa302470d8668c9ee76e55657a70ea78085bcff6159c6c9e2c497dd073e0ecd25b2e3ff16795859b6fa04fa3cb9dbc07d5f28
SSDEEP

384:yBs7Br5xjL8AgA71FbhvJUfWGUfHjtmjtd5NaMR5NaBQZbHN9+tcn8ID+973u:/7BlpQpARFbhiWb8naOnaBaJ9+qDO3u

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3130) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkWatson.exe.mui.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hu.pak.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_zh_4.4.0.v20140623020002.jar.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-util.xml.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-modules-appui.jar.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Blanc-Sablon.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-13.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Internet Explorer\en-US\networkinspection.dll.mui.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\larrow.gif.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Mendoza.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\userContent_16x9_imagemask.png.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glass.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jre7\lib\ext\jaccess.jar.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-execution_zh_CN.jar.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_ja.jar.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\en-US\Minesweeper.exe.mui.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.DataSetExtensions.Resources.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Management.Instrumentation.Resources.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libsdp_plugin.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveNoise.png.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet_3.0.0.v201112011016.jar.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_zh_4.4.0.v20140623020002.jar.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_zh_CN.jar.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jre7\bin\installer.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dushanbe.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_zh_4.4.0.v20140623020002.jar.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Godthab.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Menominee.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jre7\bin\jdwp.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\vlc.mo.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Norfolk.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.properties.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\day-of-week-16.png.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_zh_CN.jar.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-views.xml.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Mexico_City.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tabskb.dll.mui.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\javafx-doclet.jar.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\DisableSet.xml.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jre7\lib\jfxrt.jar.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l1-2-0.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Mozilla Firefox\mozavutil.dll.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Thule.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_ja_4.4.0.v20140623020002.jar.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface_3.10.1.v20140813-1009.jar.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-impl.jar.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe
File created	C:\Program Files\Java\jre7\lib\meta-index.tmp	e4cd4575d842ed1822c15f32e8df2ef0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e4cd4575d842ed1822c15f32e8df2ef0N.exe

C:\Users\Admin\AppData\Local\Temp\e4cd4575d842ed1822c15f32e8df2ef0N.exe
"C:\Users\Admin\AppData\Local\Temp\e4cd4575d842ed1822c15f32e8df2ef0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp

Filesize
84KB

MD5
ec2b4aecc655b43751b90697ee0156f0

SHA1
ccdaab114156d9f7470131b79f4536e737404ae1

SHA256
0c0de641966f278a1584b112caf04aa38a7ba0c8867f0951ee909d4498a4ff78

SHA512
8a718fff5f9bcfb4f29a836b73524afee920bb4b0d83bbe2762cfed8d9502aee9ae5ec14ac0e37b6f225176c0d75c15f73d3c9145218948ed2692a55c75d5cef

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
93KB

MD5
3e9a29c831f55b5126b9a251606abef1

SHA1
dcde3374780cfb6923df818d81b3bbd479d3d6de

SHA256
2773615e576ecc49656591e2ef0ca3c69ce9b7b283ee26e39ccc284fcedbf0e7

SHA512
1ef97eceea70218a706266dc44ac1959ca90d7b1302f6a711cd7c6bf1ea79696a7ab24a4c3577119b193ac7acc6ebf57cbc2651416f16f321871515ce24383f9

Download Submit
memory/860-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/860-70-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download