Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 03:30
Static task
static1
Behavioral task
behavioral1
Sample
0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe
Resource
win10v2004-20240802-en
General
-
Target
0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe
-
Size
77KB
-
MD5
6af4e35786f59bc134b9d6eab9fe5020
-
SHA1
1a1c1c01f7d5757f41faf2f9acae28edac550db6
-
SHA256
0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8
-
SHA512
ce1361265d11eab12beefc3dcf7e92e01f13eec383f99862448837a50530efa780d85900547feae3a52ba703fe9f1562cd62bd4e7138ca94a484af72136793c7
-
SSDEEP
768:W7Blp+pARFbhtlmlQ3y3RWvf+wi1x9f+wi1xBTCcX8vgCcX8vSd5hdx8O/Gum/Gs:W7Z+pApfGQ3y3RWvfmRfm9sKsSd5Nkd
Malware Config
Signatures
-
Renames multiple (338) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha2.png.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bg.pak.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\cloud_Thumbnail.bmp.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-US.pak.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_ButtonGraphic.png.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InputPersonalization.exe.mui.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\IPSEventLogMsg.dll.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_SelectionSubpicture.png.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkWatson.exe.mui.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\System\ado\msado26.tlb.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\colorcycle.png.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\DVD Maker\es-ES\OmdProject.dll.mui.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\7-Zip\Lang\sa.txt.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hi.pak.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Internet Explorer\en-US\jsdbgui.dll.mui.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\7-Zip\Lang\ca.txt.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\7-Zip\Lang\da.txt.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\MSTTSLoc.dll.mui.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\System\ado\adovbs.inc.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.tmp 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe"C:\Users\Admin\AppData\Local\Temp\0b009081c4e6137fbed30b8d29149a8bb44a694afaf58a41f8b2ac3b6c72f9c8N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1848
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD5f7e0435dbaa6880bef4e82fc2ae141a2
SHA121d654f0baed6bcf399cef99204e165f90ebdc9d
SHA256f14dfdfac042041ac3d0b505bf01486c18bdb347e7f6a2ff2ae6f15e38ac3ba0
SHA512ac257647507d92d638ca7010c2baa85fd7ea8848a01e32a30cc1fbefc2fe549a4f0f44bac227088195476375cd1a9d4ba18b5e61448140be92894e1339537bd5
-
Filesize
87KB
MD59cf134114d26f21e81c0badbd5001c92
SHA15af5b7f42891220c6da8ae828cfa74e533ec4234
SHA256802243a29c283d384061d6aa4b3ecb326c250562b49a93475573fb838dc7c06a
SHA51260158f2cabe6d76f351d9c3ace5b607c1ab6591e38dc4f52a94ad87fac4b02ef8defb4e5ab5684680c417beda9e09e049fc5ca4e598dffb68afad2f33b0e9463