04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-09-2024 15:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
Size

44KB
MD5

79c534f41de6a1b90ed5c4c8b4aa1380
SHA1

b44969b909bbe82a3efff03b694b3455ae25066b
SHA256

04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6
SHA512

8f13b2908db011ef705abdf5591291fdfde143ff6c975821c1842c880ab0707432da893705b7900785f5830a934f127b8e2c5fac24b275083cc71b8b1ed1a290
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lsScc/:W7ZhA7pApM21LOA1LOl6vScc/

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (719) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Knox.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\DVD Maker\de-DE\DVDMaker.exe.mui.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bn.pak.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader_icd.json.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ko_KR.jar.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jvmticmlr.h.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Araguaina.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\ShapeCollector.exe.mui.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\da.pak.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\prism-d3d.dll.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsTap.dll.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\charsets.jar.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\meta-index.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcfr.dll.mui.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\wsdetect.dll.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Internet Explorer\perfcore.dll.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jvm.hprof.txt.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Maputo.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Cordoba.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belem.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\DVD Maker\Shared\Common.fxh.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_it.jar.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\LICENSE.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_elf.dll.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
File created	C:\Program Files\Google\Chrome\Application\master_preferences.tmp	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe

C:\Users\Admin\AppData\Local\Temp\04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe
"C:\Users\Admin\AppData\Local\Temp\04b2d1af1e989694b291206bdc63de759b702c0e0aebdd23d48433101432e0f6N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini.tmp

Filesize
44KB

MD5
c6ae308a193c5f4596bf254aacc7f4fa

SHA1
bedd7dc42749c39ef942e9105a46d1eed8057d2f

SHA256
4469f4708d9aaf902aece30f48c814bc0cb79325c4dbb1bd816f1fda5f5b9524

SHA512
41c4404753f8c2ffb729b5e7ce1f5c81a8ef50398144a249d14164d515942f674946ce0a4f371c66adb4f456f9c1f19a669b6dbd3c2cb6fd4b918bb65e39bb54

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
53KB

MD5
fd3b122b7838a5d9a8309d26b57a109d

SHA1
39b364d5b90ac4c94c1d75bbc09b606877bd3847

SHA256
9b8ef1bee4c99282456accf53d78c7d4c717c4ffbdb638c9a89a20a21348c6a4

SHA512
a4bbe76acd65ada64ed16308a01a3e75a487fefa932c53d11075dcb4e9d6047dbfd2df298bec18b51b4eb237a3e7daa3e25debb0f678cead32824c0be12205ee

Download Submit