Analysis
- max time kernel
150s - max time network
124s - platform
windows7_x64 - resource
win7-20240611-en - resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system - submitted
13/06/2024, 19:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe
- Size 94KB
- Sample240613-yaastaydnb
- SHA256 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f
- MD5 dd8f040751d51cef6c920474cfe543dd
- SHA1 dc28a6258ba6335a6a92535d7c785a3d014a9d6a
- SHA512 3eb7c3a9c89e5f53af75f076f8af57592eeccbba4e52e76ac2d472325f55179bd59ea6578c5aabe26e8e9b4e2d0eae9083723827ccb6201ed4899add5f9031b5
- SSDEEP 1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPN8Em:6rWpcOPxPke+e3fFpsJOfFpsJbgEi
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (597) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunjce_provider.jar.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_CN.properties.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbynet.jar.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\7-Zip\Lang\lv.txt.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\7-Zip\Lang\pt.txt.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\msvcr100.dll.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\icudtl.dat.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ur.pak.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\npdeployJava1.dll.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nl.pak.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\micaut.dll.mui.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\DVD Maker\ja-JP\DVDMaker.exe.mui.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_ButtonGraphic.png.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ar.pak.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sl.pak.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\7-Zip\Lang\az.txt.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\msinfo32.exe.mui.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Google\Chrome\Application\master_preferences.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\7-Zip\Lang\mk.txt.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.dll.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_ButtonGraphic.png.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\flavormap.properties.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\micaut.dll.mui.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcfr.dll.mui.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\DVD Maker\PipeTran.dll.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\rtscom.dll.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jawt.dll.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\el.pak.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\chapters-static.png.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\FormatConnect.exe.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_es.properties.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui.tmp 1417a18384e6ae06a43b160307c24bb773e45538eacc70cb4e9e03ff8f9e828f.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-39690363-730359138-1046745555-1000\desktop.ini.tmp
- Size 94KB
- SHA256 30603c2cdc25530ca4bcd3508fc9cf9abc872ece6ff9ee296268ae4da8c55f23
- MD5 247a06b33a771a22e72856e9f33a937e
- SHA1 f50e641157b3331089036a0f7d024dcb5f13d6ca
- SHA512 2758bd6380ce4ab1f99a3980d15f5b24fa387f6ade1cb8d1c93b97b34fc497a4c40e7a8ed6df135414afc62ce0e449302c3aa3c2f8e64d1b43fa07484142709b
- SSDEEP 1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPN8E6:6rWpcOPxPke+e3fFpsJOfFpsJbgEu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
- Size 103KB
- SHA256 f2bd336e918ab06f9557c4e597c224183774dc61299153e65e75c6d84f5d086d
- MD5 0a5613163d93ab4b2909131c15d5f56d
- SHA1 4e109afe5d27f678ee23f4df8ac39357bd086414
- SHA512 3006d3da2b83be23f6074b2a1eff52e9e59e24a32857ea1990c6e03f2bceb4fbf33249845b70227092bdcd23eb211b324e37791167c16a147982b1d09a44e0e8
- SSDEEP 1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPN8EE:6rWpcOPxPke+e3fFpsJOfFpsJbgEI
- MD5 SHA1 SHA512 SSDEEP