9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 04:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
Size

47KB
MD5

75c825948d9868509c24bef0b829b0b0
SHA1

b98a8bb5d900ff1067d133e4dc48ab35016b5c34
SHA256

9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916
SHA512

b910471af0428256a280f427523b01fbaea35268cdb5c982a97baae575714db1d4a5671d7019325b003d4c2a4b502e346536b82f430e26530a9ef187336311ec
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42Lcfpb2N231F18jybCPi1x+jybCPi1xo:W7ZppApBULcfpHLcfpSo3fOBaqBa8

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (1176) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\tipresx.dll.mui.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+11.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+4.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\DVD Maker\DVDMaker.exe.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Maceio.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Cocos.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ru.jar.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\gstreamer-lite.dll.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Sakhalin.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hu.pak.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Monrovia.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sl.pak.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Internet Explorer\en-US\F12Resources.dll.mui.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Istanbul.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_SelectionSubpicture.png.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fr.pak.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jce.jar.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsHub_is.dll.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Internet Explorer\jsdebuggeride.dll.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pl.jar.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.bat.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsTap.dll.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkClientCP.bat.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe

C:\Users\Admin\AppData\Local\Temp\9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe
"C:\Users\Admin\AppData\Local\Temp\9f42a5284df7e2e94110229950f333a92f0d8148995eaa14d7ef0fb501ef9916N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini.tmp

Filesize
47KB

MD5
7fdb8dd0709377f6fbfa8dcf378aed23

SHA1
933dd75cb9dd64fc6472e840206dcf48d6b478cb

SHA256
c16d1a33eaef143bd09107be1034bbc8742aba8a6a450726d2f247c44393cdab

SHA512
199f819c8274a13f0e88b44ab63fe7c1dcdc5b5d57ccf3b88894196cde1af23285b3edf25e2ef6cd0d0f6a6ef0f9314fdcdfc3f643f46cfc7b3cca572fd4cada

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
56KB

MD5
924ab9d60ab761243e45d6c4f559ba9d

SHA1
b50d811020d1e49fd66dfe889dc275ceecce65f8

SHA256
d99b7e797159f425fd7beca3e57700c95d79a783c61ed029a203eb3be619df2c

SHA512
d5e1caeea3ee07eae04e4e6e4cc42aa1d174ac52dcf5b0bc7c2f9d0ba79ab4d1a34e1b08fbf362b257ddd701e4918061a85f00dd32cd6c6552f2e5936898491f

Download Submit