c77eff773598db457e8f45206a410b0e97242f2e4b077a9b6620f54e53b332f7

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14-08-2024 10:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3849bf72e3fd1c8577cafa0d75648d60N.exe
Size

52KB
MD5

3849bf72e3fd1c8577cafa0d75648d60
SHA1

d57c04ac813ff1a5ed633c1f0f9ce62cbb1e4e49
SHA256

c77eff773598db457e8f45206a410b0e97242f2e4b077a9b6620f54e53b332f7
SHA512

7af40b2d60f5de8b399e560b38fccfc9d06c5548e5acfcc8b020b55388ef464129879f44da27fa4961c8bcaa88f6fab782d24300703828d611c17fbc0792929a
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFY101g3B3WnSdWTW4:W7ZppApBULcfpHLcfpyDrnSdWTW4

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (435) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Internet Explorer\pdm.dll.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-imageMask.png.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Internet Explorer\D3DCompiler_47.dll.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\MSTTSLoc.dll.mui.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tabskb.dll.mui.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tpcps.dll.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\DVD Maker\audiodepthconverter.ax.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\vistabg.png.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\tipresx.dll.mui.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\DVD Maker\fr-FR\WMM2CLIP.dll.mui.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\DVD Maker\ja-JP\OmdProject.dll.mui.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\3RDPARTY.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\DVD Maker\Shared\Filters.xml.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\FindMerge.m3u.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\DVD Maker\OmdProject.dll.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Internet Explorer\jsprofilerui.dll.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader.dll.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576black.png.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ta.pak.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_SelectionSubpicture.png.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_scrapbook_Thumbnail.bmp.tmp	3849bf72e3fd1c8577cafa0d75648d60N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3849bf72e3fd1c8577cafa0d75648d60N.exe

C:\Users\Admin\AppData\Local\Temp\3849bf72e3fd1c8577cafa0d75648d60N.exe
"C:\Users\Admin\AppData\Local\Temp\3849bf72e3fd1c8577cafa0d75648d60N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
52KB

MD5
e8fcd45a0edeed93b0aee560f38072a0

SHA1
94e9cc3c830fbbdbe6e40ec0ea5393df1d02e7b3

SHA256
fc5eeb5164f1f1433a2a9d234bdceca7bda7fcc9a5b6240899342134eeaa706f

SHA512
789094671bf31f8682556406052b58deb8731c4eceee1bdb4144acf1c6f47e6a2e13d22c4a1e624a36a035f34e91bf0c3a3808850683d0b863634cb2a69fbabd

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
61KB

MD5
13981c638643ebb819c3a1f41b6a1be4

SHA1
ce22bd03f52cfd48728cd5b7fa140437af7e7796

SHA256
28d7e2a3edfe7c037754cda71bb05071836a382d2e3e9c9237c0aa4fbc1d0c7f

SHA512
532a8cb8f7c8f54828e86049766128c7a56c459407881bb744b5f3b699709a8d351f7d96065f39e717f53b1c25fa8f59cace631e752135b470ac0fdeef7e600b

Download Submit