e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
Size

48KB
MD5

c6f0e710a5d898ae3340426a7cff3c51
SHA1

87d4e31d4ccacf120afb305a2b6ed38b8d31268a
SHA256

e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c
SHA512

4aee040294789b52d58444a59d945499f7d6be32c2b6e93ed80e01508d3c4c8d97257e5e46319a812f8e04550b2777e9c3e7484cc1cef2c74cf790bff7eaf487
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42Lcfpb2N231F1itvtc:W7ZppApBULcfpHLcfpSo3fstvtc

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3808) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\npdeployJava1.dll.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\eula.dll.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Phoenix.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Sydney.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.ServiceModel.Resources.dll.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.conf.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\es-ES\Minesweeper.exe.mui.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Palau.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_zh_CN.jar.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-3.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\liba52_plugin.dll.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\vlc.mo.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\blank.png.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipBand.dll.mui.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveNoise.png.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Internet Explorer\en-US\F12.dll.mui.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.bat.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jre7\bin\dcpr.dll.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Fortaleza.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Midway.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mac.css.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_zh_CN.jar.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Nipigon.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Rio_Branco.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_ja.jar.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\chkrzm.exe.mui.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_ja_4.4.0.v20140623020002.jar.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Management.Instrumentation.dll.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG_PAL.wmv.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Internet Explorer\Timeline.cpu.xml.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rankin_Inlet.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-awt.xml.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\release.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_zh_HK.properties.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\rss.gif.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nb.pak.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.service.exsd.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7MDT.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Halifax.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dili.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Xml.Linq.dll.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libaudiobargraph_a_plugin.dll.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\JSByteCodeWin.bin.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\timeZones.js.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_zh_4.4.0.v20140623020002.jar.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-execution.xml.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Troll.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_srt_plugin.dll.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libvoc_plugin.dll.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libtaglib_plugin.dll.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hovd.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_zh_CN.jar.tmp	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe

C:\Users\Admin\AppData\Local\Temp\e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe
"C:\Users\Admin\AppData\Local\Temp\e0a1093ab2214103ac3c4783d9f48463302a80616a56662fb2e9ef843788ef5c.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3533259084-2542256011-65585152-1000\desktop.ini.tmp

Filesize
48KB

MD5
39f885316bd6982a67a89c929edcb6b1

SHA1
1b1078682f6d94d7cceec95d3cfa6f4ad27eefd5

SHA256
a9940eaea69833bb5ff5e35644e6f3c8a17711f65fed8ebdb23ac632105fcb4b

SHA512
e473a424d413ace37c9a8ba37b2e305bba83b755908099ebf953d1ba387ddb5bda99bce8f795cad1fa87166d0a1d88574f351364983503eecbb6f0225364107c

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
57KB

MD5
00dc8ad09c44c5f8d7255bb9a1505315

SHA1
734715a74159619537f3c37d4f87b5f63bb50f21

SHA256
0f4cf4fe3ada95d870d4ba2a6d52e9fa5eeacff336e87407d730a6b0febb1fa8

SHA512
78f44de6f6245acc1a3599ae22e396cad048adc93ae070c093dd36c3830809d9316f21f834762664f4fc4f30fe7ea47f50147bcd56d0d68cffa920a58d2ddf72

Download Submit