db4456c0cc5318f717bad8fd016b634f34bef4c9fe7a3d5b371f9a889f2ed928

Analysis

max time kernel
119s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 13:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0ff0746b27fbc5795fc2f651e8fe50b0N.exe
Size

58KB
MD5

0ff0746b27fbc5795fc2f651e8fe50b0
SHA1

47418fefce38315bc5b165d6a11654adf9a5d248
SHA256

db4456c0cc5318f717bad8fd016b634f34bef4c9fe7a3d5b371f9a889f2ed928
SHA512

851a9095c5a98fc2369339afe0000fb2f4e487a06cd12e9bdf6fc75bcaee1c56a68348ac31ff9fd28a4a91c4fbf886ee2910c52aa32af1ab5741dfd1c3976c5a
SSDEEP

768:/7BlpQpARFbhfUnUNRawAlW1VkRawAlW1VE0AVaK0AVa5:/7ZQpApfWELkLE0AVaK0AVa5

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (314) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\DVD Maker\Shared\Filters.xml.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_ButtonGraphic.png.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\ConvertSend.mht.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\7-Zip\Lang\ne.txt.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\id.pak.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\7-Zip\Lang\pt-br.txt.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask_PAL.wmv.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\203x8subpicture.png.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ru.pak.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\1047x576black.png.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\7-Zip\Lang\pt.txt.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\1047x576black.png.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\DVD Maker\sonicsptransform.ax.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpnr.dll.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720_480shadow.png.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\DVD Maker\ja-JP\WMM2CLIP.dll.mui.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_selectionsubpicture.png.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_elf.dll.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg.tmp	0ff0746b27fbc5795fc2f651e8fe50b0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0ff0746b27fbc5795fc2f651e8fe50b0N.exe

C:\Users\Admin\AppData\Local\Temp\0ff0746b27fbc5795fc2f651e8fe50b0N.exe
"C:\Users\Admin\AppData\Local\Temp\0ff0746b27fbc5795fc2f651e8fe50b0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
58KB

MD5
e743966750abc0029770b30230f7735d

SHA1
9c6ccf0f2f2cb09495a70fe6d139ef0223d23f52

SHA256
7a8adf69ff791c1573fef5346742b1f7ce2e83bf4f93813514232415a15bee8f

SHA512
58687206d03a2e44de6c53c288e5c10510c1658f0182aeba4d0359f5f12baa7451255c87fc6ba01f72ddf7aeb63093aec6a40bed89ac2d1c543b6f73b84b6245

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
67KB

MD5
ee0b964d9dc5855088c0a50adda5271a

SHA1
3e11453863025c7a9e548dfb5c8080ab80433606

SHA256
c41ba57852bc15fd08f92a48849310956db30dd5c5a52af267cefb9ab6c5e99f

SHA512
f5aaf05ac9c53bed72d92936816d83fcd6e5fdf3cb2c5948744aea8584867382d5c57989a87f4fe6fa298fb375a38eb6ed735ff93182bc036da67676cb0f4c36

Download Submit
memory/2924-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2924-68-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download