e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325

Analysis

max time kernel
150s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 05:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
Size

83KB
MD5

1d00d9973e7528c4506dd6a7c498f898
SHA1

41e288ad19c619b6d59a89c0e69cc958784b5368
SHA256

e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325
SHA512

86091025f96b95498023d3a597c639cdcf2edb7888e77058e88c3ce2cd678b83388f8266b2766544f3e5d6ce48feaea9ebca62a585a1a8b1bd2cb9fa50c2fdc8
SSDEEP

1536:W7ZhA7dAZ1++PJHJXA/OsIZfzc3/Q8asUsJOLKc/xJtLJtTGlMV:6e76mQSohsUsUKk

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3749) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\npdeployJava1.dll.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Vladivostok.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Printing.resources.dll.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_SelectionSubpicture.png.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Java\jre7\lib\cmm\sRGB.pf.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tabskb.dll.mui.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\config.ini.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_gtk.css.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.CNT.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_mmx_plugin.dll.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\41.png.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_ja_4.4.0.v20140623020002.jar.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Java\jre7\bin\dtplugin\npdeployJava1.dll.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Java\jre7\lib\javafx.properties.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dubai.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\calendar.html.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\MANIFEST.MF.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cancun.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\La_Paz.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\UTC.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\cpu.css.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\picturePuzzle.css.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\46.png.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-fallback.xml.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Java\jre7\lib\zi\CET.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kuching.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.RunTime.Serialization.Resources.dll.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\cpu.css.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_SelectionSubpicture.png.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayenne.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-visual.xml.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services_1.1.0.v20140328-1925.jar.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\gadget.xml.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\search_background.png.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montevideo.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Uzhgorod.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\MANIFEST.MF.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Background_QuickLaunch.png.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Windows Journal\en-US\jnwdui.dll.mui.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\chkrzm.exe.mui.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.Speech.resources.dll.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\vlc.mo.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\logger\libfile_logger_plugin.dll.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\manifest.json.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multiview.xml.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_zh_CN.jar.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\hxdsui.dll.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\combo-hover-right.png.tmp	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe

C:\Users\Admin\AppData\Local\Temp\e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe
"C:\Users\Admin\AppData\Local\Temp\e1f92558d8278bc0ca5c0f789fdf8ebb02a7f20d5d4e26be8869eb309557c325.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
83KB

MD5
cb720f5d3c4027ef5104ba220cf65238

SHA1
a0e007c7f254aeb2b09e66f2ae850738275a94c9

SHA256
1f4472b6ea6a08d4876d2e872c7c6b9ba61c65f8ec28a52a4acdc5a8f4bac272

SHA512
19b96cdea1a8ec6cb40b90446b9424b3fbabe0853ec0dbc9489e0f73de5dab07711d4df480002d93d98af01754ae76b016fd592b28c6747cce7e6065d797e747

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
92KB

MD5
f39bc5f78018cee16ad815427815f628

SHA1
7bd7e4850a78fde155391e738f075411d516f530

SHA256
42364114c2183472b8cdc5c939f76aa35afdf2a2bd72c1d2df09d3f7b92a0575

SHA512
bba0cf3c6a17ab531664f3e3d2ac671c913073f4c3c33854b31438797b2e7e6764fb5a7542a0501fbda1328bf21be8c2d2dee0db33ffb5734c38c9566d64281b

Download Submit