Analysis
-
max time kernel
121s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07-09-2024 11:53
Behavioral task
behavioral1
Sample
fee2092a21c018d2e7d4fbdbf5016660N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fee2092a21c018d2e7d4fbdbf5016660N.exe
Resource
win10v2004-20240802-en
General
-
Target
fee2092a21c018d2e7d4fbdbf5016660N.exe
-
Size
27KB
-
MD5
fee2092a21c018d2e7d4fbdbf5016660
-
SHA1
e0546a58b6f473350922663544c83a5a9368e0a8
-
SHA256
fc34c08295f1825e6df37a174400d25f6fcb6aada160ac84c10ecd9300ba8261
-
SHA512
b91cdb3618425f4f80efb40fd7df90f72dd14a3389dda1d14b22465b8442cde325bcbc7a15c5dac2996ae2b962e25bec919a447ef552085d0659e64e90ab299d
-
SSDEEP
768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9Ro+QOViJfo+QOViJurN8:CTW7JJ7TPUnN8
Malware Config
Signatures
-
Renames multiple (327) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/1320-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000a000000012233-2.dat upx behavioral1/files/0x0002000000010480-6.dat upx behavioral1/memory/1320-18-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ro.pak.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_ButtonGraphic.png.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IpsMigrationPlugin.dll.mui.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\7-Zip\Lang\ast.txt.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\7-Zip\Lang\br.txt.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\7-Zip\Lang\ug.txt.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\7-Zip\7z.sfx.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitevignette1047.png.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\manifest.json.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\icudtl.dat.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720_480shadow.png.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_widescreen_Thumbnail.bmp.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\DVD Maker\Shared\DissolveAnother.png.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\1047x576black.png.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\Common Files\System\ado\adovbs.inc.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_SelectionSubpicture.png.tmp fee2092a21c018d2e7d4fbdbf5016660N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fee2092a21c018d2e7d4fbdbf5016660N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27KB
MD5f7a35e0e37fb95a84bb44ed6caf88828
SHA1379af7c0e84bb421754542c046943477338cb27d
SHA256262bf337dfd382a223cac49a99375fad2b5a0c510cf2b08fc17ace1a62e08680
SHA512e595b385e18adfc616b20983144141db148f7a2374d86cf2f1c9292d921e05be430c64190048a793199c173b72c7b037b4bfdb555572b73c581b3be53d2b42f3
-
Filesize
36KB
MD5bccb71fad4bb41ecd59093dcd3d9afe5
SHA15b72f3d1658d977a0d560171aac7baab21219420
SHA25644c6aa37763541d20bc6485ac993f5d1bdb5b8055c8c6fa77866f4ed3a81274c
SHA51265582419f52772d5f82d37085bf2ddc8e85839ff276ec4a2469577bfec4cef8e5aa27ac3affb904a5877fdcf2da7b3b34a6570acb4047a8f47a07869ef283896