e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
Size

46KB
MD5

947c7b62465097c426111fe3a2e6fd32
SHA1

c74d7c789b960b5ed291a2331119344664f9dc61
SHA256

e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b
SHA512

00042e958c4289ace4b1a9ab7afdcf8ac8d5af4dd95236f2e185957e63cd834ec0fa887a34dc4ff7efa60e3b9a9e2ec7433d6a02457600795ec15038c8b2df41
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOd+QRKZ9:W7ZhA7pApM21LOA1LOTRKZ9

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3778) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.annotation_1.2.0.v201401042248.jar.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\flyout.html.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-output2.jar.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-ui.xml.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationFramework.resources.dll.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Design.resources.dll.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\7-Zip\7z.sfx.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\RSSFeeds.js.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-windows.xml.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwasapi_plugin.dll.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Urumqi.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler_1.2.0.v20140422-1847.jar.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_over.png.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_SelectionSubpicture.png.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_ja_4.4.0.v20140623020002.jar.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\delete_over.png.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libupnp_plugin.dll.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.jpg.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-io-ui.xml.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Java\jre7\bin\msvcr100.dll.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.properties.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-timezone-l1-1-0.dll.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_avi_plugin.dll.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_m.png.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\MSCDM.DLL.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Chihuahua.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\rtscom.dll.mui.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Mozilla Firefox\vcruntime140.dll.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt_0.12.1.v20140903-1023.jar.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application-views.xml.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh001.htm.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaes3_plugin.dll.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfxrt.jar.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.concurrent_1.1.0.v20130327-1442.jar.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins_1.1.200.v20131119-0908.jar.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\vlc.mo.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Windows Journal\Templates\Month_Calendar.jtp.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\blank.png.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\45.png.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861261279.profile.gz.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.svg_1.1.0.v201011041433.jar.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core.xml.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-execution.jar.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_zh_CN.jar.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\Microsoft Games\FreeCell\it-IT\FreeCell.exe.mui.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_SelectionSubpicture.png.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\vignettemask25.png.tmp	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe

C:\Users\Admin\AppData\Local\Temp\e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe
"C:\Users\Admin\AppData\Local\Temp\e537bcbf1596a17642761be0655a48fbbc7c4ea8b3804b66b06026cef17f1b3b.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
46KB

MD5
9be27a6ee01f9bb776c4c1ed6d9e3eed

SHA1
396715aadb770c6b14a22b96834e59cfaf438b9d

SHA256
a14fd3409f10d8ba2f7938fcb78d7a759b80a8c33edeaf306164939a8d5b1c6d

SHA512
a2c0e6a79d226a600b72d9033cd23ae6176b94f78e896189e49819193ffca95f856497d11aa3d38a78c8c8338bbae11be8be38459b5a4359c9b43353adf20196

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
55KB

MD5
e4e242de8e341955a206d6b9c75e3e10

SHA1
446d6be11af7bbc35ba094dcc05a5e14f345909f

SHA256
7a363be45dd3b483bd82cc52bf9b2ea1bbc4ac92c4686437caef06f169c975e5

SHA512
efa18b62550f24fd36e6025aa20255a143317f5150893b99aba0ccd5bd6d162a81847a95f7b3a385657cca74080f123318c4237bbc843f6088ee0661b4b1a96b

Download Submit