73a93df08bcee446a1774a1416cedd94b9cf0840b6a89dfcad9bcf86373db32a

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 15:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

716e4eb6c8f26e8daab50daded930440N.exe
Size

1.1MB
MD5

716e4eb6c8f26e8daab50daded930440
SHA1

9131849371f9b2f87477f7dbf1f83bab9bdadbc1
SHA256

73a93df08bcee446a1774a1416cedd94b9cf0840b6a89dfcad9bcf86373db32a
SHA512

4409a1bec01a6c0c8ec091b52eef7dff9da6b813b577b7456d282994767d9a14fb2a890891e753e17de04c96d40ff4460d87f448477114670105b85e003f4bfa
SSDEEP

24576:xKCNJhOvQFoPFuEpu6NfEl1hM5IUtG5Yekc3g5:xJWQFoNuEpFN8ttV3g5

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (449) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipRes.dll.mui.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720_480shadow.png.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Google\Chrome\Application\master_preferences.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Internet Explorer\Timeline.cpu.xml.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyrun.jar.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpn.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ja.pak.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Internet Explorer\en-US\eula.rtf.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkWatson.exe.mui.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\MSTTSLoc.dll.mui.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\DVD Maker\SecretST.TTF.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bg.pak.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\micaut.dll.mui.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fa.pak.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.bat.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\FormatGroup.au3.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\cloud_Thumbnail.bmp.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop.wmv.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	716e4eb6c8f26e8daab50daded930440N.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	716e4eb6c8f26e8daab50daded930440N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	716e4eb6c8f26e8daab50daded930440N.exe

C:\Users\Admin\AppData\Local\Temp\716e4eb6c8f26e8daab50daded930440N.exe
"C:\Users\Admin\AppData\Local\Temp\716e4eb6c8f26e8daab50daded930440N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
1.1MB

MD5
a22795e84fbc68fa3f240727beb32b4a

SHA1
b73f81432832f8d0096881ab4e91c34ab87baa95

SHA256
61e85d39b560ef9da65b9f00263bf6625ccdc67644fd5ecfa91a2cf716b7a166

SHA512
83de8cf204691e21bf4cd60d6e71511bd31bc4fbf69990588fb478ff360f3cd72ea508bfa5cf93c657ec88ed3c5444b495a533b54e719ff98f6f2aa2cd0c4a72

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
1.1MB

MD5
12f5fa1e194596a6e4512aa1d75f8835

SHA1
1d264be9d2f8645099af76742423864c78287319

SHA256
fa9a5dfc602a72973eb091d098016e6e682022632a4c65fdc73d3f73f886ee8d

SHA512
b8e9dd415c7891b4d2f0b7e2756d4858af86263f06ba672df09ef416585406152dd2d9c2f3e8cd7b5ac77bf218d82ee20ade3015781934e8935faa38386e1406

Download Submit