103dde27696e76d4d080c3068b5e24dbe69dc7f0723feae106022f7507ea050a

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06-08-2024 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

374bb901919d766419c43d47569f1910N.exe
Size

195KB
MD5

374bb901919d766419c43d47569f1910
SHA1

bc06b6831da3d88588174ef1e6cccf7e3b59a9a2
SHA256

103dde27696e76d4d080c3068b5e24dbe69dc7f0723feae106022f7507ea050a
SHA512

5149530b77aa494f74d388701dd285525d8183865effe8fcc703fd2c114910e792a831202fac023af8dfdc56795a50993bd2413d3f9a1caadc29c5817f662d17
SSDEEP

1536:W7ZQpApfytyxsks0DjdesgHOsXOHepOHep:6QWp1sksHsuOs/

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (235) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_ButtonGraphic.png.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tipskins.dll.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_widescreen_Thumbnail.bmp.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonSubpicture.png.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\DVD Maker\PipeTran.dll.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\DVD Maker\it-IT\DVDMaker.exe.mui.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\DismountSave.wps.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_plain_Thumbnail.bmp.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\DVD Maker\bod_r.TTF.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\DVD Maker\Eurosti.TTF.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\micaut.dll.mui.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\System\ado\adojavas.inc.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipBand.dll.mui.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720_480shadow.png.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\msinfo32.exe.mui.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.dll.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\DVD Maker\ja-JP\DVDMaker.exe.mui.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_item.png.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tabskb.dll.mui.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui.tmp	374bb901919d766419c43d47569f1910N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg.tmp	374bb901919d766419c43d47569f1910N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	374bb901919d766419c43d47569f1910N.exe

C:\Users\Admin\AppData\Local\Temp\374bb901919d766419c43d47569f1910N.exe
"C:\Users\Admin\AppData\Local\Temp\374bb901919d766419c43d47569f1910N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
195KB

MD5
ca3b02e4479310789ac2357eddc1e6e0

SHA1
56ceaa64c5098191189b256044c30c569a01713c

SHA256
3eed8d3512e617da886747f0c87ff8aaa4fa3c818d367db94473eff6175965e6

SHA512
b5eb971ed0a656c0828278ba23d151262394e92d5815c9064ad2fbcfe0c2b12ad3baef5879ed6ab82c526177bb783da6f584fa6e64e57468a359ba43b3583f89

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
204KB

MD5
a865437f9c0cc872bd40f27e632cc941

SHA1
c1802b27250dc82aba72e4a3179e29ef9573b6ca

SHA256
12f851bf388fd77119ee8fb0a57feb66a7bade34f44d62889570533bba71bbff

SHA512
de5a38f90fc08f1b0fc4bd0e8fb96ce0bdeff07254bcdb088cc965c01d423d3ef9bc95a4ac18e5210044e8985ca3223b1d658e1fd50ec46a6415cb8ffa54ae3c

Download Submit