eeb2e667118b8967e59551d1ab2491fc0f136a6e5af4353055e7b47058118da0

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/08/2024, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1b01116ac44f622587fc5e8a28b911f0N.exe
Size

53KB
MD5

1b01116ac44f622587fc5e8a28b911f0
SHA1

19e1c8cfd1db0447030b4ab046814434bfcac4de
SHA256

eeb2e667118b8967e59551d1ab2491fc0f136a6e5af4353055e7b47058118da0
SHA512

65b0856093a62bbc2d70e9f063b5a67c24583c94890eae1195d74edc749b6da1860f12d6b266c14293f2f4023775c389c25df6781e557f4ae2e8e13f1dea1a6a
SSDEEP

384:GBt7Br5xjL9A7AgA71Fbhvyu7uGYSinVtYSinVwb1W3WAuO:W7BlphA7pARFbhpYSiHYSiZ

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (327) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\imjplm.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\System\msadc\handler.reg.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\MSTTSLoc.dll.mui.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\DVD Maker\directshowtap.ax.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_scrapbook_Thumbnail.bmp.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcfr.dll.mui.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_postage_Thumbnail.bmp.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcfr.dll.mui.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwritash.dat.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\d3dcompiler_47.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\1047x576black.png.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_SelectionSubpicture.png.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\da.pak.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\DVD Maker\ja-JP\DVDMaker.exe.mui.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InputPersonalization.exe.mui.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_ButtonGraphic.png.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Internet Explorer\F12.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_item.png.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1b01116ac44f622587fc5e8a28b911f0N.exe

C:\Users\Admin\AppData\Local\Temp\1b01116ac44f622587fc5e8a28b911f0N.exe
"C:\Users\Admin\AppData\Local\Temp\1b01116ac44f622587fc5e8a28b911f0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
54KB

MD5
7629d3415fcbf5a04cd00eb25458d8c3

SHA1
65614b55561bbb4de27be05c03d1617885d0cde0

SHA256
9c9fc7bde7fd1658c00351902f3e0dab9eb653af6c54bb936ab67d02aa76ee93

SHA512
708e79ebd2484d21990a4ab1d6b6ef5e359fe7ec6d527532417b26dfbcee351072cea4b4e18a494c78eee63cdf96ef062af9226b90042ce257063440ee9357cd

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
63KB

MD5
4d5c15781c4d18b3d4e6adb232c21a51

SHA1
f0477fe7115eb9a6743c4751768b3a298982946b

SHA256
b7ccd304402a7a4fe0dfe126043af785be41ab650646bb23647850c6b5e7c3b1

SHA512
595ec02c74fc52b3953913f81056e28b6e6e408a2c99a250454d1e57ff50f63ca50fb8946b09ba9bd6d7980d91ff1986eccecfde7e36df34fb376ed45dfe9378

Download Submit