2cd3a54a797707ebc51379983bb0e8da8ac951fb708f80ca319606df49c88c7d

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 18:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab6fc0cb87c9065206af045775f54190N.exe
Size

35KB
MD5

ab6fc0cb87c9065206af045775f54190
SHA1

dea9bf417b86ec931b949857594f2a37e00ec713
SHA256

2cd3a54a797707ebc51379983bb0e8da8ac951fb708f80ca319606df49c88c7d
SHA512

b4a1ebee232580f63d7d6c71152906fd5d92d0c1d6955b3f79ab8d80055e88fd110a4969e1c6c56265978d2fa2b44a7cca2ec76bead46227da3f83948a1ac094
SSDEEP

384:GBt7Br5xjL9AgA71Fbhv7bhv3KueKudLl++KKdXdO:W7BlpppARFbhjbhPKueKudLw1KNO

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (475) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeush.dat.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\MSTTSLoc.dll.mui.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\1047x576black.png.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fi.pak.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sw.pak.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Internet Explorer\en-US\F12Tools.dll.mui.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader_icd.json.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InputPersonalization.exe.mui.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\whitemenu.png.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipBand.dll.mui.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Common Files\System\ado\msado26.tlb.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Common Files\System\msadc\handler.reg.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoBeta.png.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Internet Explorer\msdbg2.dll.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\vi.pak.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_ButtonGraphic.png.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\GoldRing.png.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipRes.dll.mui.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\tr.pak.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\rtscom.dll.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\DVD Maker\de-DE\OmdProject.dll.mui.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png.tmp	ab6fc0cb87c9065206af045775f54190N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sl.pak.tmp	ab6fc0cb87c9065206af045775f54190N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab6fc0cb87c9065206af045775f54190N.exe

C:\Users\Admin\AppData\Local\Temp\ab6fc0cb87c9065206af045775f54190N.exe
"C:\Users\Admin\AppData\Local\Temp\ab6fc0cb87c9065206af045775f54190N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
35KB

MD5
25f04432b92590c5474580c60e92522d

SHA1
2f8944b12a93d912c8ca4177a54aee8ec3ded6ff

SHA256
2e71fd836d720713c486556d5f041e717ff2b9c16afc79a137ab4e8aa35d70b4

SHA512
c0f4df42f130738559060dbe38b2f4cb21fd6f40586d00b47d6774fffedad956d10f9b391d3ebda465a3ab0853b4447f7f141585d65cc76bbb6eb11e4dc80d16

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
44KB

MD5
19a15e98840520dda4b462cfaf8eca65

SHA1
cbb9b44a86db4fec2f3c0d62bb9003b6bbfeae39

SHA256
8c380f424e681f30e9435740d54068488478bb4f38f83aa635dcdbc853f3982b

SHA512
ae4b622e440e3fbdafa6671e672c83a767336d191a48358e27ce1a717a788bcaefbd22a9ca9f0749eebc51c82e23060738588434f6a456ae42350469623f5873

Download Submit