d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831

Analysis

max time kernel
150s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
03/08/2024, 03:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
Size

73KB
MD5

4e7a7980c152749ea7127e5f6392ae74
SHA1

8493e58c30def15d7c6de75c4ce1bc557d311c14
SHA256

d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831
SHA512

c23c838d39240b0c60603ef8e5790c2d374846f44839a8a5fe29d9ce26b220a6b2063b3e1563f0114b0efee1b7421fcebda577b45ffd4fa3e89f923bc1c20cce
SSDEEP

768:W7BlphA7pARFbhvOsTKnKqtb4HBZjlwGpCYnigugqOzM9bdifwMtxEwJjlVkTZ2g:W7ZhA7pApvOsOKM4HBhaGwOQ54xEIjl8

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (856) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javaws.policy.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunjce_provider.jar.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Hermosillo.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Internet Explorer\en-US\eula.rtf.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayenne.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ja.properties.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground.wmv.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-US.pak.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_ButtonGraphic.png.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tpcps.dll.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.properties.src.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh88.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\1047x576black.png.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ru.pak.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tunis.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_mainImage-mask.png.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_specialocc_Thumbnail.bmp.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Internet Explorer\F12.dll.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_hu.jar.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbytools.jar.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_sv.properties.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tabskb.dll.mui.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Internet Explorer\ieproxy.dll.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\DVD Maker\it-IT\WMM2CLIP.dll.mui.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\cacerts.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Pangnirtung.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Amman.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Resolute.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Google\Chrome\Application\master_preferences.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe

C:\Users\Admin\AppData\Local\Temp\d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe
"C:\Users\Admin\AppData\Local\Temp\d9a66df23a3f945a9ad08ba678aaf65ac0904d524f04325f1c4bb301092cd831.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
73KB

MD5
3fa5e36ae57611f87a703f7dc22da019

SHA1
52da79a1ba5eb83079d34cc7533a6ecbe88e5043

SHA256
02cb19a27b40365a63116c5ecbfe82c9a5e5625e9a58dfbe6a651daa5adbebbc

SHA512
b4bfd6788c554e2539e60c09eb4e9695dc7623005c468f671827d21b0e434ebca0598fb46df21008c07ee00641ded8e19e59f43d8b44bf3a8d34da0f50c3c8a8

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
82KB

MD5
4eaa1e9b2214162c3fc4d86f6fc7e879

SHA1
6879a4699d74f69b600fb90a37e413f60a07c61b

SHA256
8cd4f4ba9d6371da62844246d5093ab1a86601d5be218cb4f1b7cef2f78c20e2

SHA512
94a1f8ea06cd54fadf5bba8bdb7b6d028d721e38b4e9a03d19bebfb4e9add3cbd0f3a5a75749a176814d72fe0c53ffb62c14cdb1df3a67646fd6486380b3a1ad

Download Submit