03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc

Analysis

max time kernel
150s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 18:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
Size

38KB
MD5

2da6dc2b887a07ae16e6253287fb7bc7
SHA1

fa1197105eeaa446bf335607bd685c27829014b2
SHA256

03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc
SHA512

311e11b67db7ee231b8f76d3c276c5bf3728574a8535f8e133d1d606d95dd6be59482d7a888d0f387ff42a51ba195a2c3bf69f9e5329a0fd324a527dd881fcf1
SSDEEP

192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vB7m/FJHo7m/FJHA9jxjiOmPOm9Ie1GMG:yBs7Br5xjL8AgA71Fbhv/FSX9U0qrD

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (517) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveAnother.png.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\travel.png.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\7-Zip\7z.sfx.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Common Files\System\ado\adojavas.inc.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\ExportConfirm.wmf.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-US.pak.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\msvcr100.dll.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\rtscom.dll.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\tipresx.dll.mui.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\vi.pak.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader.dll.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pt_BR.jar.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\fontmanager.dll.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ja_JP.jar.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-CN.pak.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Internet Explorer\MemoryAnalyzer.dll.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sl.pak.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\ShapeCollector.exe.mui.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_cs.jar.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\npjp2.dll.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\MSTTSLoc.dll.mui.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_SelectionSubpicture.png.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIconSubpictur.png.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bn.pak.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.bat.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml.tmp	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe

C:\Users\Admin\AppData\Local\Temp\03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe
"C:\Users\Admin\AppData\Local\Temp\03b52d774152f0ec0ed9068c196c7d08f399b93368b498dde0eecb3512b2a1dc.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
38KB

MD5
65ceab60b89bd750789f5509a3e4a28c

SHA1
10d1ac1f358b49589e2190bd5ab6c1f401479521

SHA256
7dc16d9af01f03ef82b6371ed81c04370defa1cf5b1abb321ddd97ab3594da12

SHA512
d6708769b7f5bc6c0b3b9af247f2ed5a2999923794dc16d0193935c0fe8173e18a13ef3d664277e3df4abb135472ebf1e41ca49e9778b752b044e9caa677803c

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
47KB

MD5
973a2ef246adc47e86556ce0d9d85065

SHA1
47dbb8c2f4659c6e8896a87da13d93e134fb6fa5

SHA256
3e3310197394d2e073e36a7a836c082be612ea2976ea2cb8ccb4eef57bbb03d4

SHA512
fe5b734c3caef0018c8fc45554f520b31d6aae68a01488aaceaf8284a4d780ae341012666dc02f2ae557130067280817dece82b109739c06afcbf8a27e91b68b

Download Submit
memory/2152-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2152-50-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download