Analysis
-
max time kernel
60s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 19:25
Static task
static1
Behavioral task
behavioral1
Sample
26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe
Resource
win10v2004-20240802-en
General
-
Target
26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe
-
Size
62KB
-
MD5
2ead3c28410de382e0cb99df9fb6b641
-
SHA1
d91c097363beaa81f518e0268e4e8c72617338fe
-
SHA256
26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397
-
SHA512
175a7251af345b23a74a60b9d2bf05ede6dff351642987f69f0cd620d1ade4fc9968c4a9ea30b44316bf19695aa2865d79c75c6054f87ea4596f0362b1f9f215
-
SSDEEP
768:W7BlphA7dASbS7EXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKeM:W7ZhA7dAynMdyGdy7YRY4rhrI
Malware Config
Signatures
-
Renames multiple (198) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\7-Zip\Lang\gl.txt.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\7-Zip\Lang\be.txt.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\7-Zip\Lang\fur.txt.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\7-Zip\Lang\el.txt.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\7-Zip\Lang\af.txt.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\7-Zip\7-zip.chm.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\7-Zip\Lang\vi.txt.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\7-Zip\Lang\mk.txt.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ShapeCollector.exe.mui.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\7-Zip\Lang\kab.txt.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\7-Zip\7zFM.exe.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\7-Zip\Lang\an.txt.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\7-Zip\Lang\pt.txt.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\ShapeCollector.exe.mui.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\7-Zip\Lang\az.txt.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\7-Zip\Lang\ta.txt.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\7-Zip\Lang\uk.txt.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\7-Zip\Lang\io.txt.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\7-Zip\Lang\tt.txt.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\7-Zip\Lang\ca.txt.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\micaut.dll.mui.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\7-Zip\7z.exe.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\7-Zip\Lang\et.txt.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\7-Zip\7-zip32.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe"C:\Users\Admin\AppData\Local\Temp\26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2728
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD538524803f0ec196d2670ac8538c24dcf
SHA14260e895864f0ae530860a26bbf05156e50a0941
SHA2569c9657dc2056cdc9bdb83e81872e63f4a36437f488f2d5de9f095a28528db91b
SHA512290096ebee5744b16caaefba8657013710bde3436b5bd3732d0cac9e7303fb56d84da82ca3fc29653205ffabffbc9f6e54b0c5792e919495d5af562186195b9c
-
Filesize
72KB
MD5d26bbbd2e5e78a2ffdcce91424c3cd63
SHA13231b0ec9e897da49e6c4e4701977812245f8c01
SHA25654f32a66d7b522c6628bbb78c27acbe8e54e9e8307f5bd8cf3521bdc93189173
SHA512792e4499494bf3c53293bb5ce7ce1b7107361e639f6f7cf978f553a6b207120120025fcac2b6690b71ad37105b10ee293306f2fdc4afb7b9e98cb01d235c4b82