46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa

Analysis

max time kernel
149s
max time network
21s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
27-07-2024 21:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
Size

97KB
MD5

cf37d9030308abe36d5e01456893a920
SHA1

e0c20107e2dbeaf1ba365c8693592cce4b825fc1
SHA256

46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa
SHA512

7981b5428025a70ab229f47566a714a48509003faad0527fa033b8feedb254491e1f46cc124fa185c7678ad4a9788b240acb7e17fdd8bdc83ef0e793209f9857
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBt:PqFF2Ie+effyL

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (339) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\id.pak.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\MSTTSLoc.dll.mui.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-backglow.png.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hi.pak.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\button-highlight.png.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_ButtonGraphic.png.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\icudtl.dat.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\ImportPop.crw.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\es-ES\MSTTSLoc.dll.mui.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveAnother.png.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hu.pak.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_SelectionSubpicture.png.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_ButtonGraphic.png.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\vi.pak.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_SelectionSubpicture.png.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\whitemenu.png.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-over-select.png.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\desktop.ini.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Internet Explorer\en-US\F12.dll.mui.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\el.pak.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Common Files\System\ado\msader15.dll.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Common Files\System\ado\msado20.tlb.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\DVD Maker\fr-FR\DVDMaker.exe.mui.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml.tmp	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe

C:\Users\Admin\AppData\Local\Temp\46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe
"C:\Users\Admin\AppData\Local\Temp\46d216d2dd82e6d71273535df04747cfecc37ae100822dca50290dcd7eb858fa.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
98KB

MD5
afda0b02acca4aeddb269a993126a254

SHA1
70205f21898055b03e45e4595518cd2d7b075dc9

SHA256
40cc6bbd0819f066de71167623567deb623fc50f77d6833210aae8df3c2972bb

SHA512
facdb8662982e7b446abcfaca73ceb26a9a11ff6c47bd8b61de80acaeb65277527126171369427cb0ae7ab8204919c5728e38279f96eda4e635412cac0a4648f

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
106KB

MD5
e68f5432ac31a65e2708ea3bf50b9899

SHA1
16d7f05c3c4a9f5566da6f84e80e652500332a5c

SHA256
a13fcc99f94048afa9c283da10a1003a452338046fddcfb4162f1dbb0161e2cf

SHA512
d55fef544c3a06850b1da4d5f081636415f8f0230b2af47f2274ba5133bf2e1f51e7bf7ddc670f1856e3f1d0da3b772db9f9e37239f69f17218d28f926b88771

Download Submit