ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492f

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-09-2024 09:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
Size

49KB
MD5

7b0740c276685b6617c36a7e014b4ab0
SHA1

b0dc8930ecee697842b7c0749139e905ed4f57ff
SHA256

ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492f
SHA512

27422415ab44d7540535aade263b5425b6a210b804457246ccd75057b642108cc47c59296fe0a465f16b25936c74cd9d06e63a1f45dc363833d10603a660bee5
SSDEEP

768:W7BlphA7dASbSjJJcbQbf1Oti1JGBQOOiQJhATBWvyBh85c53J6XJ6M:W7ZhA7dABJJZENTBWv36hJ6XJ6M

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3249) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.properties.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\help.gif.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse_2.1.200.v20140512-1650.jar.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-tabcontrol.jar.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\ant-javafx.jar.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Fortaleza.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Brunei.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Sofia.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\libfloat_mixer_plugin.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\DVD Maker\fr-FR\DVDMaker.exe.mui.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\vlc.mo.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\sRGB.pf.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\MANIFEST.MF.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\core_visualvm.jar.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClient.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Chagos.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jre7\bin\sunec.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\MAPISHELLR.DLL.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpnr.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveAnother.png.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher_1.1.0.v20131211-1531.jar.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Grand_Turk.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Seoul.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Microsoft Games\Solitaire\en-US\Solitaire.exe.mui.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\vlc.mo.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_ja.jar.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\01_googleimage.luac.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_zh_CN.jar.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.Design.resources.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.bat.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\El_Aaiun.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\updater_zh_CN.jar.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-1.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-utilities.jar.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClient.resources.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Utilities.v3.5.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\vlc.mo.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.xml.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\librawvid_plugin.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Khandyga.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\com.jrockit.mc.console.ui.notification_contexts.xml.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands_0.10.2.v20140424-2344.jar.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Lima.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Rome.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Niue.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Xml.Linq.Resources.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyclient.jar.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-uisupport.jar.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClientsideProviders.resources.dll.tmp	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe

C:\Users\Admin\AppData\Local\Temp\ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe
"C:\Users\Admin\AppData\Local\Temp\ea951021d4798edb0ccdb2fbd207b34fb1aadd3885b51f8987a2013939d2492fN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini.tmp

Filesize
49KB

MD5
54d27f78dc98d17254eb7ac6d9810eed

SHA1
ca23f7510f9ee65c875fdcfc4db11fba8d3a6215

SHA256
a7351c44d348f5f6960b00fceb0897b45903d812c878051c765d33013fe47e33

SHA512
ec7fcc3ff9c1ccfb9d475d2fcb4ea8f71e978801714e1e52fbc14f04c140b5c11ec6ae68423e3029bc12c32e5e0bbe3f3864e0d0d058e2ce8d726e6432f7aff0

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
58KB

MD5
3899855a196c7ce42a891ea1f7cbbe40

SHA1
6066ce241851d7218885f0e886bee37fda267d4c

SHA256
f4cf483ec9af1268610e013315d2f8f0f62c4cc487c00166c0536b11c999ef43

SHA512
9e3da98d9bcc6b70ea6cb174f52822d8ca259c1f6c1bd4524c76400cc1ffc587813aae213887719784cfcd9a283710980e004aeb279bab8deefe574aa4f00236

Download Submit