e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2a

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 23:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
Size

40KB
MD5

4a0d1b68153e1aa6b06904456c96d6c0
SHA1

e76cbe787e7f486d9384803401542e90e2568bfa
SHA256

e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2a
SHA512

d6bddc4443a68fda07aa33334afb9ecf00ab9a40f08175930e5d9b49bd3ddf7fcf3822e6281762af9c8a1574fcd0b45c1616d4b12c5dcbf7a9117a6b3ec8cdfc
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lsSGV0g:W7ZhA7pApM21LOA1LOl6vSGWg

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3441) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jre7\lib\security\java.policy.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.zh_CN_5.5.0.165303.jar.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-outline_zh_CN.jar.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler.xml.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Design.resources.dll.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Catamarca.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Center.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.properties.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-multiview.xml.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-api.xml.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Resolute.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\VideoLAN\VLC\skins\default.vlt.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.RSA.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcfr.dll.mui.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cayman.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libattachment_plugin.dll.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcfr.dll.mui.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\DVD Maker\it-IT\DVDMaker.exe.mui.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveNoise.png.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-progress-ui.xml.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-compat.xml.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sampler.xml.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jre7\bin\eula.dll.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\vlc16x16.png.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Internet Explorer\en-US\networkinspection.dll.mui.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guayaquil.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtobe.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\toc.gif.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Macau.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\SkipPush.inf.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\te.pak.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Internet Explorer\en-US\eula.rtf.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_zh_CN.jar.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-9.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guadalcanal.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\visualization\libvisual_plugin.dll.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fa.pak.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ro.pak.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_ja.jar.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Resources.dll.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.jetty_3.0.200.v20131021-1843.jar.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.xml.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Ndjamena.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup-impl.xml.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_ja.jar.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\PST8PDT.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe

C:\Users\Admin\AppData\Local\Temp\e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe
"C:\Users\Admin\AppData\Local\Temp\e7cd883f0938e9f70b73f58b13dc579019079b364209400c2dd1df99dcf14b2aN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
40KB

MD5
2bf61362916c1f7ce37f241c441cf7f9

SHA1
7faf37acb0ff264f667527163c63e8348a9dcc47

SHA256
8cc4c3a503ff72befcd1b88ad6c5279bd7fd109f73f29c63666e9d13199d172c

SHA512
bab0a4b0c5a9ccd031477ee993799d3f5cb89656ba280b940df1566304d1d8b33548609dcfd4a9470c5a71d12f6da3e067a39bf3d0f35f133e0baec9d33624ff

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
49KB

MD5
05cb66d27a3b22fef70ce8c0f26cb942

SHA1
08233a406fda68a6b5687707b42dd219c56d36e4

SHA256
555db8d0ff8042b26f9d8f655a98d14490fea44c236d06bb508c16d3ad293f27

SHA512
235e5a33a8b656534947b0d5e25925ffe3a3a20738622bddbb4249e3b74e7779bca745f9c69346747c3ade8bf2c083b1ec0a929daec79e9df990c1062fad0755

Download Submit