7a4d5594d4a001a7a0c3fc5e4d668fafd11c886b1c2292c8c9f141476e75492e

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 04:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91d49a7f2efd17d52f281fcd22057e00N.exe
Size

56KB
MD5

91d49a7f2efd17d52f281fcd22057e00
SHA1

f7739eddf9753c66bf4d1f450221d7d367be7519
SHA256

7a4d5594d4a001a7a0c3fc5e4d668fafd11c886b1c2292c8c9f141476e75492e
SHA512

bb0f39cb4f79cce24db2670e74adb5cd1dbf0bfff6359e11e503711b811439c20a0315a14be6e4a77dad439637f6833f886cfa75603b1da432675071da287cb7
SSDEEP

768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcXcMcGK1KK1YnG:/7ZQpApze+eJfFpsJOfFpsJMTE7/

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (983) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxwebkit.dll.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Internet Explorer\Timeline_is.dll.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipBand.dll.mui.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\DVD Maker\Shared\Parity.fx.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_plain_Thumbnail.bmp.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\GroupEnable.ppt.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Thimphu.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jawt.dll.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\javaws.jar.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rainy_River.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Omsk.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_ButtonGraphic.png.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Panama.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Vostok.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+8.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Cordoba.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\alt-rt.jar.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\te.pak.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Internet Explorer\MemoryAnalyzer.dll.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunec.jar.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Sofia.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576black.png.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\instrument.dll.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\hprof.dll.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\tzmappings.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Merida.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\tipresx.dll.mui.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\MSTTSLoc.dll.mui.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv.tmp	91d49a7f2efd17d52f281fcd22057e00N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	91d49a7f2efd17d52f281fcd22057e00N.exe

C:\Users\Admin\AppData\Local\Temp\91d49a7f2efd17d52f281fcd22057e00N.exe
"C:\Users\Admin\AppData\Local\Temp\91d49a7f2efd17d52f281fcd22057e00N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
57KB

MD5
47e3910f4c1e4285db16f3d445656aef

SHA1
1f86184be3856e090f589b81f796528e4e532d22

SHA256
d1e5f69a700373d601aecab7a2f252faa9774b51f4c79645c6c0593dfed21fc1

SHA512
bcabdcf6a3eaae929598770fd411e97a79d04b77389de7906ddb78a0ec6b744b9558996d0ae56af4e1ccdd8cff0d46cb096a7bc06fe3d54cb87d3f7b6e23545a

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
66KB

MD5
86f4aaa4483b15fa71db8e9a516a529e

SHA1
ac7307d0bd237fefba905d7ecf466926c1c437b5

SHA256
82a1ff60da562253e67287da85a7fe1958183e7a2007aba681759029d1fb9603

SHA512
27f2d7cd3f6db8441353ace591d8146ab99c4a7c4f5db48a2d3dd02b67be1160250b425360cd56aa9c2ab28b2ba17994fcfb3a548d13088d8181fa20c4b05568

Download Submit
memory/2720-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2720-98-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download