Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
19/11/2023, 01:53
Static task
static1
Behavioral task
behavioral1
Sample
57e2b4443e3ae17d48c1664b70de1730.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
57e2b4443e3ae17d48c1664b70de1730.exe
Resource
win10v2004-20231025-en
General
-
Target
57e2b4443e3ae17d48c1664b70de1730.exe
-
Size
203KB
-
MD5
57e2b4443e3ae17d48c1664b70de1730
-
SHA1
4e3ea315689938b66b93e4a9058ffede91c2a52f
-
SHA256
486fb689a71f94fabe0bb470513638e7aae120349917bd480a56852d932686ee
-
SHA512
5f3b602a811602c0db338b2b247cebbe74f66838d005ba6b7dae066d4b1e4140aa44e271d18f02ebf06a886c2d2dd030bed550c1d5162bdf97e93fc7cb885db8
-
SSDEEP
768:W7BlphA7pARFbhKKVeIuKVeIaCgx+qsaCgx+qswPNPz1Z:W7ZhA7pApaX0aX0wPNPj
Malware Config
Signatures
-
Renames multiple (582) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_ButtonGraphic.png.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\DVD Maker\fr-FR\DVDMaker.exe.mui.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoCanary.png.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack.dll.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\7-Zip\Lang\af.txt.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\7-Zip\Lang\si.txt.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_SelectionSubpicture.png.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-PT.pak.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\7-Zip\7z.dll.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\7-Zip\Lang\kab.txt.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\7-Zip\Lang\ky.txt.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\zip.dll.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\7-Zip\7-zip.dll.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkWatson.exe.mui.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\t2k.dll.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\glass.dll.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_CopyDrop32x32.gif.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\7-Zip\7-zip.chm.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\7-Zip\Lang\et.txt.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\wsdetect.dll.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tpcps.dll.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\DVD Maker\directshowtap.ax.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Internet Explorer\F12Resources.dll.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Java\jdk1.7.0_80\include\jdwpTransport.h.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeush.dat.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Internet Explorer\en-US\F12Tools.dll.mui.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\7-Zip\Lang\is.txt.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\micaut.dll.mui.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp 57e2b4443e3ae17d48c1664b70de1730.exe File created C:\Program Files\DVD Maker\ja-JP\WMM2CLIP.dll.mui.tmp 57e2b4443e3ae17d48c1664b70de1730.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD536532e47a237f592456d125d70594c2c
SHA17342dda1d9b9713b6302dea442c4181c80216a4e
SHA25659a842422a7aeec0597f47b8edb9bff937f984966a329200096bbe7eddee35f7
SHA5129a7b345081c2642eb2c7c6ee5e3b865f01d016a5318cc9f1332da40b6c867914fac4dae7363c27c61533fc667b5edcccadc149ed02d5355d4aaf2151fdc50a9f
-
Filesize
212KB
MD5e1a6930f600050c36f050a13ec266936
SHA197f476f08ff42f57b9bddc7b42946663e2927cba
SHA2560af258be0ad86556128d23d350696b64abf9656a4fc299e18f559302540dd827
SHA512e362642c362acf3cdd28a30abb67bfde06c7390fcd3c7d5905893689d0f33bd0ac07bbcc583daded3c6a15c970cb7a35022d330194dbf3190fc79e6d65e3ffae