e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 04:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
Size

61KB
MD5

6a3884c34d43271b0e7f06ce15961970
SHA1

513480bb4e813e4ec6603731b0b6a9951cd99c04
SHA256

e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60
SHA512

d1453f11dbaafc8584d67dc8c169bfd2af5428612f64888c064846d30304310891b320154b0ca631f8828cc8e58cdd83da8ce6b1ac0d2f736931fce86bbb0396
SSDEEP

768:W7BlphA7dASbSjJJ1EXBwzEXBwdcMcwBcCBcw/tio/tiBhRK7:W7ZhA7dABJJ7TTQoQNK7

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3315) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_realrtsp_plugin.dll.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\CST6.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\vlc.mo.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\vlc.mo.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Internet Explorer\networkinspection.dll.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-11.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_zh_4.4.0.v20140623020002.jar.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_wav_plugin.dll.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_zh_4.4.0.v20140623020002.jar.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jre7\bin\jabswitch.exe.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\mojo_core.dll.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glib-lite.dll.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-fallback.xml.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_it.properties.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Lima.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.bat.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Creston.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-outline.xml.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-uihandler.jar.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup.xml.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\DVD Maker\es-ES\OmdProject.dll.mui.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\en-US\Solitaire.exe.mui.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\vlc.mo.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-options-keymap.xml_hidden.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Pago_Pago.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationProvider.resources.dll.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\liblpcm_plugin.dll.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.c.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rightnav.gif.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_ja.jar.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jre7\bin\server\jvm.dll.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Metlakatla.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_ja.jar.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_zh_CN.jar.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.commands_5.5.0.165303.jar.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jre7\lib\resources.jar.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\vlc.mo.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\1047x576black.png.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia_Banderas.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\ShvlRes.dll.mui.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\plugins.dat.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_zh_4.4.0.v20140623020002.jar.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jre7\lib\flavormap.properties.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist_jstree.xml.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\00_musicbrainz.luac.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sampler.xml.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jre7\bin\management.dll.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Java\jre7\lib\javafx.properties.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\msinfo32.exe.mui.tmp	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe

C:\Users\Admin\AppData\Local\Temp\e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe
"C:\Users\Admin\AppData\Local\Temp\e1f945acfd77e1215ef73f2cdda0bc3b0eab44176606db727308ebb944642e60N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
61KB

MD5
b9547ca3f45581f05cc0b565cd19c195

SHA1
91a5ac31e060257f781c9e94f0b24d87a867eb3d

SHA256
9e47ce36694037a93db1213030fa629e132cd5696b9a280d622443f897207bf4

SHA512
4f5f6fa91edf74a120c4005130924867c56f9117eda6e737ae281e3c910f3a4742afb2a5a7c71cc45c4e436126ea2107bf3b8f838fd1eba1747dfbde2044a7c1

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
70KB

MD5
a3f74d1bd10e2f1bce908ac99a347dce

SHA1
4801207945bc2adc814f865926a3e329df657c01

SHA256
af0bc22802c26dfa0ed5b8b6c6883a286d8ce45bf7d643ed27780e4f4f756c6e

SHA512
5ed9432bf3f6525790ac7bfff2a66fcaa6de5b74ad8b521854f19dcea835fba38413f10d9845f23e5551cf694e9c3b3efa24441b03c76800ccf82dd98c44bfe8

Download Submit