87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069

Analysis

max time kernel
149s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 23:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
Size

74KB
MD5

865bb9421fac472c372b27ace94e57a8
SHA1

b05a6d16abc08cca908b6d4c44ba12585d5e8984
SHA256

87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069
SHA512

0a8e639cf39a17641a56e0a760f3b6d2bde47c93b9e0550c0548ad9b733723e470e418279cccf3d020a38b2fb45a05482e0348653852a12b25a37d81906659b0
SSDEEP

768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcC+3mC+3meDAfABJ6fABJwEXBwzEl:/7ZQpApze+eJfFpsJOfFpsJ5DD

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (589) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\icudtl.dat.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Internet Explorer\perf_nt.dll.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.cpl.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\es-ES\MSTTSLoc.dll.mui.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Internet Explorer\pdmproxy100.dll.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\DVD Maker\de-DE\OmdProject.dll.mui.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_ButtonGraphic.png.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tipresx.dll.mui.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\MSTTSLoc.dll.mui.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxwebkit.dll.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightItalic.ttf.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-font.dll.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssv.dll.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Internet Explorer\en-US\DiagnosticsTap.dll.mui.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JdbcOdbc.dll.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\blackbars60.png.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.dll.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ml.pak.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunec.dll.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\MSTTSLoc.dll.mui.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tipskins.dll.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Common Files\System\msadc\msadcf.dll.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogo.png.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dcpr.dll.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\jaccess.jar.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe

C:\Users\Admin\AppData\Local\Temp\87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe
"C:\Users\Admin\AppData\Local\Temp\87579c1914596a7874e47d8361658d7eb9b19ca80c6585bab99a9b6f30679069.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini.tmp

Filesize
75KB

MD5
8e2f8e47cf51d95c830068f8530d8782

SHA1
16ae3683d83330902b854800271828a96ece3312

SHA256
314c73c8024aca39b45e7b694d63a3e277dd8c57c23a0e3579b809d4f3635bfb

SHA512
0bb2d43f00dd7d9718951fda62985b29de5733a78769bba27f2db9d1758508171d8e6369421cf5909a5d9ccd37ddb394c12cae6c00ad2152b014d939c2033b4f

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
84KB

MD5
af79a48022fdd5e01b67e572e9110745

SHA1
d46b84689565ff023560503bbc40c5d98a0d09e8

SHA256
b016baf7a15b5744a945160bbc4f18ff11468a16e80f0d94dde4a8550a61287a

SHA512
2e4660804123a5881a83e1ae57f468b66faa8c636e6ce4200560de7283ba7c7a976b12ca8475db499fb1858626335097cfc7b2628c17e0397637cf9f8931a2ac

Download Submit
memory/2260-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2260-20-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download