7526fe0e5e736caa9bbf61e279bdd8f4cbabd5081a40aac9e7dc18318aace233

Analysis

max time kernel
119s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 21:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cbaea6ef3bf93e207c6910a53ed030e0N.exe
Size

40KB
MD5

cbaea6ef3bf93e207c6910a53ed030e0
SHA1

9b0a9238f7c17da0ff055d437cc22dc6a79a460e
SHA256

7526fe0e5e736caa9bbf61e279bdd8f4cbabd5081a40aac9e7dc18318aace233
SHA512

8096209dfb67ba5cdc0bf89699b045b5bd81ba2095559ddfc7a1c56216760e590cc01c394f94431d8ef2617c246f6a1627489857aecf3461ca0aee580ac5fbf2
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lGK8WKnFIMK8WKnFI+:W7ZhA7pApM21LOA1LOl6NKNKnF3KNKnp

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (478) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mshwLatin.dll.mui.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\ConvertToUnblock.MOD.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\3RDPARTY.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIconSubpictur.png.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\th.pak.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JdbcOdbc.dll.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyclient.jar.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jvmticmlr.h.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.h.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\vistabg.png.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\CircleSubpicture.png.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\de.pak.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveNoise.png.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\gu.pak.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jdwp.dll.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\rtscom.dll.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_select-highlight.png.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047x576black.png.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\COPYRIGHT.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\7-Zip\Lang\pt-br.txt.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_ButtonGraphic.png.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IpsMigrationPlugin.dll.mui.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jaas_nt.dll.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui.tmp	cbaea6ef3bf93e207c6910a53ed030e0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cbaea6ef3bf93e207c6910a53ed030e0N.exe

C:\Users\Admin\AppData\Local\Temp\cbaea6ef3bf93e207c6910a53ed030e0N.exe
"C:\Users\Admin\AppData\Local\Temp\cbaea6ef3bf93e207c6910a53ed030e0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
40KB

MD5
37ea41624c903a0de9d7bb4f161b84b8

SHA1
260680caeea3e7f3973b890b65b2b08ce3f1071f

SHA256
7663d79b087ca90ed648799e42d78520f493bedfee7e8281db3789d1287109ce

SHA512
90c3fd90df4f4610f8e7a60283b10b76b048742618f8fad0fe6e5f7e89bdc760f2ef0ed0fdb9796c59be70f109712877292b9c3f187251fae246ef2cefcc44c1

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
49KB

MD5
84b404cc6b74609e8a296aad13d3f959

SHA1
fc978342e020320e7a56ba93a01d374dce83d564

SHA256
01aede5b13c4c3f36f27674554253cf8e8d68278ccbec35f806a2177ad870d89

SHA512
c8a6bcc77e43b0a66d973e831e82e13336b32b8e9e80bb859df15702b9f2d03c639ad4caf4ee84484c92708bdba6bb83dca9c80d97b1641c92886b581b8ab06d

Download Submit