d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409

Analysis

max time kernel
150s
max time network
21s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
03/08/2024, 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
Size

102KB
MD5

d1c8b9319efc2ad923c6b00c28887c5f
SHA1

0141c1488743d03898d8f10bfde284e4bb28f572
SHA256

d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409
SHA512

ea190937c7df13c023ae4484000315e899e8db9d68f6fa21db68bafbc564b457fe6651597631e09c6910d4ba481eb25098ad623a77cdc585428104f3ff8f5653
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBm:PqFF2Ie+efsim2l

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (592) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_ButtonGraphic.png.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lv.pak.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-BR.pak.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InputPersonalization.exe.mui.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\DVD Maker\it-IT\DVDMaker.exe.mui.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\CIEXYZ.pf.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fil.pak.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ko_KR.jar.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\calendars.properties.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_SelectionSubpicture.png.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_CN.jar.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ko.pak.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jaas_nt.dll.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tpcps.dll.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Common Files\System\DirectDB.dll.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\userContent_16x9_imagemask.png.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\DVD Maker\WMM2CLIP.dll.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\COPYRIGHT.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\7-Zip\Lang\pt-br.txt.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkObj.dll.mui.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe

C:\Users\Admin\AppData\Local\Temp\d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe
"C:\Users\Admin\AppData\Local\Temp\d6442bf232a69f4cb21a4b47d62aa90e39517da33fbfbe76dbf3809e78d5d409.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
103KB

MD5
854f1505878da60cf92cfc4407646c56

SHA1
7bafe8012b3637fdbd690ddb226992e9b239bbcd

SHA256
34ed1e1b2f8c998fb8f4154dd4a862f5ed0c7cdb6c519315494132e4d7b9cfde

SHA512
b86a70b0cc1be438415721aebbade96c62e1657237fa5d9a747561930a263b5b728aa56bddb9e4f14084d225eb5a3c41673ecd1ce94a45470f0c51ea2b66d0f9

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
112KB

MD5
d1846b80d378a60e77c8c2e45c43578f

SHA1
3383a13b1349dd624ed7387aeaee48a6c2edf822

SHA256
35016112e82c00ac62cd97665a75e6b95d634511fc745fa33490c76bfce876d0

SHA512
a222175f14cd49b5e347fd42092809b0bcc47bf059a710bc3139595abc489f388d3a2db576564c4b4849a65d7d5bbae0a50f90d2d406ebf36b28fcfa26324bd0

Download Submit