2d6bf28b96a9190ba2ab094be024a8404a5abf62fad22588100ab3bd3fedd036

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
02/09/2024, 06:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

24ea29a9cdd05796d1be4851d357f1a0N.exe
Size

63KB
MD5

24ea29a9cdd05796d1be4851d357f1a0
SHA1

52d4f818f20a46cdc230c7c9fc2e157d4eb4fddc
SHA256

2d6bf28b96a9190ba2ab094be024a8404a5abf62fad22588100ab3bd3fedd036
SHA512

02e268e42a87abf77ecbec6d8318b5ef7affe6d06e515eb5f3afc04fdb9c6b43c5d0d6494a54f05e58d146908363cf495d70f73704aeccfc33940aa1e5bf968a
SSDEEP

1536:W7ZppApryb81KP2awclvmxaKP2awclvmxS:6pWpi8wP2awclvmxrP2awclvmxS

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (453) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\db\NOTICE.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Internet Explorer\jsdebuggeride.dll.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\DVD Maker\offset.ax.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_elf.dll.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_es.jar.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\jawt_md.h.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\DVD Maker\es-ES\WMM2CLIP.dll.mui.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\blackbars60.png.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Internet Explorer\perf_nt.dll.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\DVD Maker\ja-JP\DVDMaker.exe.mui.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\userContent_16x9_imagemask.png.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Common Files\System\msadc\handler.reg.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\icudtl.dat.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_postage_Thumbnail.bmp.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkWatson.exe.mui.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\DVD Maker\fr-FR\OmdProject.dll.mui.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\DVD Maker\fr-FR\DVDMaker.exe.mui.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IpsMigrationPlugin.dll.mui.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground_PAL.wmv.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_ButtonGraphic.png.tmp	24ea29a9cdd05796d1be4851d357f1a0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	24ea29a9cdd05796d1be4851d357f1a0N.exe

C:\Users\Admin\AppData\Local\Temp\24ea29a9cdd05796d1be4851d357f1a0N.exe
"C:\Users\Admin\AppData\Local\Temp\24ea29a9cdd05796d1be4851d357f1a0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
63KB

MD5
cad83a5d4b7b56e14968f2ba28503797

SHA1
83faf382136a0ee1e7bd90f1aeb84e4a424574bf

SHA256
f0420991405833a67c57d119e7b6dfacaf21fea38c5a3b9d6682d2c29657f787

SHA512
c7b4a03f4fdde06ffe677dcdf8ec3e949698b842e72ad030b5c8e01b54ca87852bb0aeca301bc5b7e322996b627784b667bb94f645079cb82f97544a5c9b93dc

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
72KB

MD5
73547f970211a40a8cae244f5b4f07e1

SHA1
33ff0cd8e7a384f065c6eda7a90b3176595f3866

SHA256
dbdc08d8205da54d07351583f357e64404f5f537548ee59cb839fba259abf94f

SHA512
57080c6fa5695be23d408de3fb7ee989bafe21c4d80ad54d3e43970158fac23a8e93d655d8d814689cbaacd41c0ec8e55e4d8e20e71c0d77b80a7dbd0eeedfee

Download Submit