ecc46385dae275a92f4678377288e4dd2d3cea124a354f1a7b0c17690a037640

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15-09-2024 09:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5eb10e421380c814cea9ce612e10610N.exe
Size

76KB
MD5

f5eb10e421380c814cea9ce612e10610
SHA1

b13caaa9ed903015b9fe0f6a34693cb45541d875
SHA256

ecc46385dae275a92f4678377288e4dd2d3cea124a354f1a7b0c17690a037640
SHA512

0d818b343ec8cad4d32ac1de8cf55b3a579ed11b1d97c79f9586e76d396f585dfaa38d336f5f0319448e310efc1629bc18268ac25e043d6aa68b85aff8099f75
SSDEEP

1536:W7ZppApwEwnmJARJAaXxXNJdkCKPuJdkCKP2:6pWpUnDXxXl

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2951) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_es.properties.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Vilnius.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jre7\lib\ext\localedata.jar.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\chkrzm.exe.mui.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\da.pak.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jre7\lib\jfr.jar.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\es-ES\Solitaire.exe.mui.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.Design.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkClientCP.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson_Creek.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-settings.jar.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console_1.0.300.v20131113-1212.jar.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_zh_4.4.0.v20140623020002.jar.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.commons.codec_1.6.0.v201305230611.jar.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_ja.jar.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Kentucky\Monticello.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\shvlzm.exe.mui.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dhaka.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Mauritius.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Office\Office14\AUTHZAX.DLL.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\THIRDPARTYLICENSEREADME.txt.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-snaptracer.jar.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cambridge_Bay.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\SpiderSolitaire.exe.mui.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\vlc.mo.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_ja_4.4.0.v20140623020002.jar.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.rcp_4.3.100.v20141007-2301.jar.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcs.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8PDT.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Azores.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\vlc.mo.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-favorites.xml.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jre7\lib\ext\zipfs.jar.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jre7\lib\management\snmp.acl.template.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\St_Johns.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Brunei.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MET.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base_4.0.200.v20141007-2301.jar.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Seoul.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Indianapolis.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\jvm.lib.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-io.xml.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_zh_4.4.0.v20140623020002.jar.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jre7\bin\jpeg.dll.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.jetty_3.0.200.v20131021-1843.jar.tmp	f5eb10e421380c814cea9ce612e10610N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\vlc.mo.tmp	f5eb10e421380c814cea9ce612e10610N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f5eb10e421380c814cea9ce612e10610N.exe

C:\Users\Admin\AppData\Local\Temp\f5eb10e421380c814cea9ce612e10610N.exe
"C:\Users\Admin\AppData\Local\Temp\f5eb10e421380c814cea9ce612e10610N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
77KB

MD5
e4f692b8a196599533cd3b25b89b21a7

SHA1
a3ab95bffc745b79444950a585f55ae55e5e083b

SHA256
bb8d3e8d2993a15e7bd7d1b37b6ef5395f0faa5381430da4433d9a100032fd8e

SHA512
ed804bc5241690a7d6842c628a288e123ae7fa438e2ace8f6b6aad6a14c04bba5b45be61d05cb3d75c221f44fec17fb2f9233003835e0615023e255132238bd1

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
86KB

MD5
cf0a05f7d9da6a924aba330998d288d9

SHA1
25831938aee0def8ce6177beb9e2f1f07b66b8cb

SHA256
55f07c5c7c9862373c4a30bfe10e71825952911bb0e8feb80c3e69d37f57be14

SHA512
67aee6fa5e9d74a9d0c1590c3a61db1dc1af1b59953048fcc2a961afcd1408ba9b810dba997f3b404773acedb21130f64c0734ee23706f62574ac1667592a3c3

Download Submit