64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 12:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
Size

69KB
MD5

90d5e451c6f98ae3ebc82e20e76adaf0
SHA1

2b8aa43429b67e24ed0146dc17ec3728991875e2
SHA256

64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80
SHA512

d388b19ca865c9f215ea7cf3d3f7159dc2145cec1095d477c0afb048f1b971c70c3243cb3453f631b162c40bbf54c6f88d4a81512264540659f38dcc138810f4
SSDEEP

1536:V7Zf/FAxTWoJJ7T7jkKCVk+TXT53XB3XG:fny13jkKCeunBnG

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (335) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2976-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000e000000012262-2.dat	upx
behavioral1/files/0x0002000000010480-6.dat	upx
behavioral1/memory/2976-26-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\DVD Maker\Shared\Parity.fx.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\micaut.dll.mui.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader.dll.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\7-Zip\Lang\ne.txt.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcfr.dll.mui.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\MSTTSLoc.dll.mui.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tabskb.dll.mui.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\icudtl.dat.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_ButtonGraphic.png.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveNoise.png.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_ButtonGraphic.png.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\layers.png.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\d3dcompiler_47.dll.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_select-highlight.png.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml.tmp	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe

C:\Users\Admin\AppData\Local\Temp\64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe
"C:\Users\Admin\AppData\Local\Temp\64370fa84ea07ff148dd53db66200ae833498fb82f6b43eef8885ba228d9da80N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini.tmp

Filesize
70KB

MD5
24f19f6ad80569bd3eecc16853efbf26

SHA1
c4d4160cdab4b71b81b0fa5b208ce5dc451992fc

SHA256
fdcf924ddcc9247fb524d68789d6983016a7db4643707ce7dd0976ac7e5cdaf7

SHA512
fbbcd37161bb4b938ea6957b1c3d0e30c4a5da9b92b157d471a287ac6dce67966b0794c15501f87599da16c46b3df8326b1d1d6c4b9dba9ac180e20b8e6a85d7

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
78KB

MD5
f57de55102ec92146f6c4754233a7323

SHA1
4a6b260642714c7fa45f599d1bce07cf506e9313

SHA256
c35bb27a5357d3889219765e7dad86511b1a1e294fdfa713192fb7dfae62f669

SHA512
1b38bc5a929cd37f35a1fb0b5c1a6b3683d063fc983b1bfef6242dff6fd74dfd05d9a1f2cafa6710b3517e015aaad2bcffed38ea41e0974157f88e4b8eb0c671

Download Submit
memory/2976-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2976-26-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download