e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 03:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
Size

80KB
MD5

86205a20ddf8c9f54b0881c68cb55a39
SHA1

d8e77de055619b7b40a62c12f88e3b5ecec90378
SHA256

e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9
SHA512

fbff6ef725d076b2cd25ca90893544bd3a740d2da2cf2369c1dd91ef59b0a7717209259779805eb61d907ea1426c8e894397287cf58d2bb53a29ded2865f2848
SSDEEP

768:W7BlpDpARFbhYQkQjjIXYvPXzWPXzK3733uF4V7en5c5HChCrmh1444REXBwzEX+:W7ZDpApYbWjIoPyPoLzV7c6Sh1Xk

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3436) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\YST9.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\ui.js.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\ConfirmJoin.docx.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Mozilla Firefox\softokn3.dll.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libsapi_plugin.dll.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sampler.xml.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Damascus.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Windows Mail\WinMail.exe.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Microsoft Games\Solitaire\it-IT\Solitaire.exe.mui.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-BR.pak.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_zh_4.4.0.v20140623020002.jar.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-heapwalker.xml.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdiracsys_plugin.dll.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libaribcam_plugin.dll.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin_2.0.100.v20131209-2144.jar.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-io-ui.xml.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\VideoLAN\VLC\COPYING.txt.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Windows Media Player\WMPNSSUI.dll.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vevay.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-uihandler.jar.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_zh_CN.jar.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jmx.xml.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightRegular.ttf.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.ja_5.5.0.165303.jar.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Panama.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_ja.jar.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Mozilla Firefox\mozwer.dll.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sk.pak.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\currency.css.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Bahia_Banderas.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgradfun_plugin.dll.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_SelectionSubpicture.png.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+11.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\awt.dll.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Canary.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Java\jre7\lib\cmm\CIEXYZ.pf.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Matamoros.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\librotate_plugin.dll.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\7-Zip\7z.sfx.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Windows Journal\ja-JP\PDIALOG.exe.mui.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\clock.css.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_ja_4.4.0.v20140623020002.jar.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Monrovia.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\SpiderSolitaire.exe.mui.tmp	e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe

C:\Users\Admin\AppData\Local\Temp\e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe
"C:\Users\Admin\AppData\Local\Temp\e59db29233c1f942c5fb2d9b174083215f54c44076272c418ff7b39ba5ed01d9.exe"
1⤵
- Drops file in Program Files directory
PID:1584

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.tmp
Filesize
80KB

MD5
494fc56bdd5427a92b8fea54d0028e99

SHA1
22a45b17f85f68eac4727306561017aff717611e

SHA256
237dbe44a88ae69de9771b7af50f6ed01e69db8e27777ee64a53009c704237ce

SHA512
4e92cfa935d484063e7342eb99f7833f05ab0dbc90a8fd6de3aa0a503487f975611b6c73a28135dcaa55b0c7c6b7215d49d4eaceee56fb7fea8cc05fda530a37

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
89KB

MD5
2965a29742821f298477c9ed89a17f07

SHA1
3afe8a26f500f197303e9a2b2f23a680c339cf83

SHA256
e58c4e3b62d422ea327652a71fb25dced9bf670795a0869d67afe74f25d37ffe

SHA512
ff4f233e7e166053680bd863703eef71523c7ee7a1909ff27053dc640f1ed3112e91ef07e15cb153c569074c91f77d14ef156ce18b97e2d4b2a037885993f9cd

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads