c426e6f397349b09b88d041c6d6d580af814d24c61897aff3439b7150042b123

Analysis

max time kernel
119s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

801912fa4009fd8443406f7fafabee00N.exe
Size

41KB
MD5

801912fa4009fd8443406f7fafabee00
SHA1

6e56e93a22779875096903c5768d6a950b8f2f47
SHA256

c426e6f397349b09b88d041c6d6d580af814d24c61897aff3439b7150042b123
SHA512

bd67548711d2364b936488798efe287fb2ca8493b57c072e7d8243af9d7dbae25635b42700defb9473d85a34e532540536fa649535d32448bba51558111d5663
SSDEEP

768:/7BlpQpARFbhNIcvBsgQw58eGkz2rcuesgQw58eGkz2rcuV:/7ZQpApw

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (323) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\DVD Maker\de-DE\DVDMaker.exe.mui.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask_PAL.wmv.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcfr.dll.mui.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_select-highlight.png.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\msinfo32.exe.mui.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_SelectionSubpicture.png.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fa.pak.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\DVD Maker\it-IT\OmdProject.dll.mui.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\pagecurl.png.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_VideoInset.png.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\7-Zip\7z.sfx.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_SelectionSubpicture.png.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\DVD Maker\Pipeline.dll.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\1047x576black.png.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\el.pak.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\DVD Maker\es-ES\OmdProject.dll.mui.tmp	801912fa4009fd8443406f7fafabee00N.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.tmp	801912fa4009fd8443406f7fafabee00N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	801912fa4009fd8443406f7fafabee00N.exe

C:\Users\Admin\AppData\Local\Temp\801912fa4009fd8443406f7fafabee00N.exe
"C:\Users\Admin\AppData\Local\Temp\801912fa4009fd8443406f7fafabee00N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
41KB

MD5
8ac114605cf065652dbcb8ac357defbd

SHA1
4dd13eaec6574ab0723c1064e5f3edb8e7e76ab5

SHA256
dcb9283d9d3807967db070018d207cce6ea739f9b4d1c247e7a1ce46d6952fdd

SHA512
d41fa9e566b6ee9aa65f945e8c717e537dc085ffc753102c1d355764702967adf19c7b5224fffe9f749e81c70bba58d7805983a8449787973135802bdcf527b0

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
50KB

MD5
649da44c5d53db7ebb35299a516217b9

SHA1
e9ac1adc7aab3e02df451fa0c647e5a7566e31ac

SHA256
e4a6e871b8fa6796b0a1de048153d35ec29a28875fb3d8068c92a94a6a375e34

SHA512
cb57027d9f6354668a730b0fab7362759ed10c1f1ffdaf467b891b4a475316cb24de7c3516a5e591786da3e0c5b4b6d37c9a9d0fe9a8f006118920bda00ae12d

Download Submit
memory/2728-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2728-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download