Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/10/2024, 09:24
Behavioral task
behavioral1
Sample
2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe
Resource
win10v2004-20240802-en
General
-
Target
2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe
-
Size
54KB
-
MD5
72c81af858b4894ae917f0a1411a9c00
-
SHA1
348bda45b36d2e3f49f8a5ca6d36fec3efe4863c
-
SHA256
2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9dd
-
SHA512
faaf4552a8b0288a31ce6821587fcc70dcd7da17317fb80f26e7e88e2ae77d3152744f08cc36f17838597f0ada58066bdb2c9fa2cca396d157f5792533a27214
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9+qiuX:V7Zf/FAxTWoJJ7TeuX
Malware Config
Signatures
-
Renames multiple (445) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2124-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000a000000012233-2.dat upx behavioral1/files/0x0002000000010480-6.dat upx behavioral1/memory/2124-26-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tpcps.dll.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\7-Zip\Lang\sa.txt.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\userContent_16x9_imagemask.png.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fi.pak.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ta.pak.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\7-Zip\Lang\sw.txt.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\7-Zip\Lang\va.txt.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\DVD Maker\OmdProject.dll.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\DVD Maker\SecretST.TTF.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\7-Zip\Lang\ta.txt.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Common Files\System\msadc\msadcf.dll.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\DVD Maker\ja-JP\DVDMaker.exe.mui.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Internet Explorer\ielowutil.exe.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.bat.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\7-Zip\Lang\ext.txt.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\1047x576black.png.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_ButtonGraphic.png.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.bat.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\AssertPush.vssm.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tabskb.dll.mui.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIconSubpictur.png.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\EditSet.ps1xml.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\7-Zip\Lang\hu.txt.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe File created C:\Program Files\7-Zip\Lang\id.txt.tmp 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe"C:\Users\Admin\AppData\Local\Temp\2de3c23961af5f6dfb3b7e4a4d033b695a1dd517823ff8434d40688c896fe9ddN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2124
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD5ba82d5ff92b6fef53169b408668ffd69
SHA1d8d307ff29b28530151f1d38aa95c5a863c9b5b1
SHA2566e253906ce0a8073be009e8a15375f06c46ebe3cb1cc498f9511fd94d7de4eeb
SHA5127c39bab62dadf9eb7fc48f25b4cbcd2b534839a19c75493112fcc303f1a008fe0f1e2b3f39dced59bb1743ba894d03138ef57ce17950f563909a9c13feaf6d8e
-
Filesize
63KB
MD5aa0f730e1d95aa9d09ca7a689b011634
SHA16e32979e21d2dc7b1ade9480a1b27f11c403d229
SHA25673d797b23506faf4f50cb76a9431fcdf67e7c2906b08e43aae6682d61e36fb5d
SHA512ebea5ec812a1076a4d85f595170702534166aeba8ae8c353e8df226e54389b2fd3883cbbf6c49f43f8756eff8451e9bcbc8310afbc2ef6c84778eaf5bfd02075