b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 03:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
Size

44KB
MD5

7a3770eb9620a0bb2989536e38ca94d0
SHA1

e9bc9ace1a13230fadb61cbe52e728334cc5f1af
SHA256

b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70
SHA512

608e8e0afff5941a37e71e6f3e0759d26b353a5ba1c6289584098075a5c7030b6bb5929f3f20704be7d35743949735fc153ea6e30692621aee6e6b218652a05d
SSDEEP

384:yBs7Br5xjL8AgA71Fbhv/Fzzwz72Jwuq2JwuR0U0IS:/7BlpQpARFbhNIiJwsJwwnZS

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (481) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\DVD Maker\Shared\Parity.fx.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Internet Explorer\F12Resources.dll.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\DVD Maker\de-DE\WMM2CLIP.dll.mui.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\DVD Maker\WMM2CLIP.dll.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\203x8subpicture.png.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\203x8subpicture.png.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\vi.pak.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxmedia.dll.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\DVD Maker\Eurosti.TTF.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\DVD Maker\it-IT\WMM2CLIP.dll.mui.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_ButtonGraphic.png.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsHub_is.dll.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipRes.dll.mui.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Internet Explorer\F12Tools.dll.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Internet Explorer\JSProfilerCore.dll.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Internet Explorer\perf_nt.dll.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcf.dll.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\7-Zip\Lang\fi.txt.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.tmp	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe

C:\Users\Admin\AppData\Local\Temp\b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
"C:\Users\Admin\AppData\Local\Temp\b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini.tmp

Filesize
45KB

MD5
8fb4829c288be86c6f426eaa4791ab85

SHA1
821703d584ab8920db8ae647212aaed36b7061d9

SHA256
582d5fb9bdc9dbe074bee556de7b2e3bf657cca7394b07d2f3babed93baa6463

SHA512
ded092799c3d1ad51f924da5131517f610eec4e8e8da9bff5113c7a7b38dd181198fb55be5ef8e2a22a7a14f0c9fec405c462ca29fa777ccf845d499d161fcc3

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
54KB

MD5
aef7fb1e76eba10452355c2b1e678f2a

SHA1
db8078fe356db454867bcff32a69f6a0496cc024

SHA256
61d748bac5b9b4bb22b2aecc1279a79db874b4a02c8236745b9bdc8ca3edff62

SHA512
6ed68624af90aa5d06f9bfde15b74f5bfcdfa978a6c9f693c34fac010926ef0a3f9faa41861e41dcb16507f487e0b9741823f84f87bb143f3f4ed6436bef645b

Download Submit
memory/2108-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2108-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download