140d67885b12bed438d48db859fb2cca9bc0319d391f4a599e8ab97cfa26ccbd

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 07:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d2bc4f6a66c0e74e459082fb487d56e0N.exe
Size

75KB
MD5

d2bc4f6a66c0e74e459082fb487d56e0
SHA1

c80f2ba3d2d97d29d950077843b4ee29ea68410b
SHA256

140d67885b12bed438d48db859fb2cca9bc0319d391f4a599e8ab97cfa26ccbd
SHA512

74fb75c530a881834dea20bd18626ff165dbf1d6e3f1a6c0781a147b0da860807f18a200b56cf9e5cd33a5859eee1dc278497a5408f86a72c33a38da2bcbb18c
SSDEEP

1536:/7ZQpApze+eJfFpsJOfFpsJ5DVSWu0SWugWL:9QWpze+eJfFpsJOfFpsJ5DVSWu0SWuN

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (456) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Internet Explorer\en-US\networkinspection.dll.mui.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Internet Explorer\Timeline.dll.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tipresx.dll.mui.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcfr.dll.mui.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\DVD Maker\rtstreamsink.ax.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Internet Explorer\networkinspection.dll.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\micaut.dll.mui.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\203x8subpicture.png.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Internet Explorer\perf_nt.dll.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\CircleSubpicture.png.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Internet Explorer\pdmproxy100.dll.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\gu.pak.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Internet Explorer\msdbg2.dll.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\COPYRIGHT.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpnr.dll.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\1047x576black.png.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsHub.DataWarehouse.dll.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.bat.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mshwLatin.dll.mui.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\DVD Maker\es-ES\WMM2CLIP.dll.mui.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Notes_PAL.wmv.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\da.pak.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\7-Zip\Lang\pt-br.txt.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll.tmp	d2bc4f6a66c0e74e459082fb487d56e0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2bc4f6a66c0e74e459082fb487d56e0N.exe

C:\Users\Admin\AppData\Local\Temp\d2bc4f6a66c0e74e459082fb487d56e0N.exe
"C:\Users\Admin\AppData\Local\Temp\d2bc4f6a66c0e74e459082fb487d56e0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
76KB

MD5
b1dfb20d8c6fb647bd56b2b27500664b

SHA1
e7541e2eba2cf503d223a76f450a96bcf0779aa8

SHA256
93bf31eae33c6126af170ec18082e038b3a526d6bdad1a04ad7935462a3a04f0

SHA512
49da72d990ce521bc546593698a0cdae2eb4aca1c057fe41ba2c41fa9d7dddbd0d13a3591f544448dc7ed730573305581f945f24e6b850ffc81c1528ed0eef85

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
85KB

MD5
27ca6714398dbcc311fc39a20190d4da

SHA1
2f76c1ea7c2436e4f6bd5368a0dc517b33953a8f

SHA256
db404d0f0a7561524e945a58237c52efbf7af5f88420bcd0ff78d33f9bce3dde

SHA512
cda841fbdc8c17a0280be2a0fc40c1a46aacac48e0df4941b69cfc54029b014b0dd11ced19927212468dcaa1f2d0d5522be1a631c982f8c9d9db419944455ff7

Download Submit
memory/1140-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1140-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download