Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/10/2024, 09:39
Static task
static1
Behavioral task
behavioral1
Sample
164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe
Resource
win10v2004-20240802-en
General
-
Target
164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe
-
Size
54KB
-
MD5
389d4a450a4a18866b5458cbc9375a30
-
SHA1
2f35225a7b9c2081ce3a1b824c72717e2e0d7d88
-
SHA256
164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76
-
SHA512
0ad98fecb0303a73bc929541918b7ddb80700a7827105f24c64a8468bee0027d92cd4554ad84ef1953b3daa1c7aac27144431c62546b35844013cda5080ce056
-
SSDEEP
1536:W7ZhA7pApM21LOA1LOl6Aj8Tu8T1Rxew2wiq:6e7WpMgLOiLOAew2wiq
Malware Config
Signatures
-
Renames multiple (357) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonSubpicture.png.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\DVD Maker\rtstreamsink.ax.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_select-highlight.png.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\vulkan-1.dll.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\MSTTSLoc.dll.mui.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\MSTTSLoc.dll.mui.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tpcps.dll.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\System\msadc\msadco.dll.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\System\msadc\msadds.dll.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_widescreen_Thumbnail.bmp.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\7-Zip\Lang\eo.txt.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\7-Zip\Lang\mng.txt.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\System\wab32res.dll.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_ButtonGraphic.png.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576black.png.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader.dll.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\DVD Maker\Shared\Common.fxh.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\CircleSubpicture.png.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\DVD Maker\Eurosti.TTF.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_SelectionSubpicture.png.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\7-Zip\readme.txt.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui.tmp 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe"C:\Users\Admin\AppData\Local\Temp\164e131fe045650afd7acf6ac54f39a4904db49820961cc4cd5f1b45801bec76N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2112
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD559b3ae21e302af38fd0551f16146830f
SHA11f82eaea61e662612ad86b060a679192fa263c25
SHA2566d5ea76b88714f69babf3576f163e081c1898f9ab7de3f7e2c52105ba16dae00
SHA512f13592457e86b7354d378a8a79d9daa3e772ca189a3bf6a83840d90ca6c04e45cd7ab60e90c69b9529f3a82a41bc587cd5493149624f3a912aa2845d126cb7ea
-
Filesize
63KB
MD52a6b66ae90d97fdecf550cd0d2a669a5
SHA189252a8e2f65331027af121190e94b06b13eb12b
SHA256bc011baee168e2efded9d3d5a5ee567de7eb2a40c5ed5dbe24bca7c7ce21c0c4
SHA5124b832700c044837c1842fa67421a36f4bd3363ed670d535a025658f650b1624f26ac5f27dfdddb827256fd1a9cd5a79c4583e19a6bc302cbc9fc3ccc5bf8b0c6