Analysis
-
max time kernel
150s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
16-10-2024 17:56
Behavioral task
behavioral1
Sample
c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe
Resource
win10v2004-20241007-en
General
-
Target
c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe
-
Size
64KB
-
MD5
55fc25084bf403088db8eca691b6bc90
-
SHA1
e7e832a5441358fa01b68c8ea12571952a4284a6
-
SHA256
c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3
-
SHA512
cd9b98bf18f40917c4446075acc09b32b0f9207af9f2cc4283ffd8f494152f90facd234b4e41b975cd0b0efa02eeedcdeea8a8e6f3c3c520ade8ac83ca6da72c
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/tiPSqNEzlp:V7Zf/FAxTWoJJ7TTQoQ6qNfQfF
Malware Config
Signatures
-
Renames multiple (539) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2348-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000d000000012263-2.dat upx behavioral1/files/0x0002000000010420-6.dat upx behavioral1/memory/2348-18-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DVD Maker\Shared\DvdStyles\scene_button_style_default_Thumbnail.bmp.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_select-highlight.png.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\7-Zip\Lang\tg.txt.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\7-Zip\Lang\tr.txt.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mip.exe.mui.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ca.pak.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Internet Explorer\jsdebuggeride.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\manifest.json.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\7-Zip\Lang\mk.txt.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_postage_Thumbnail.bmp.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_socket.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\FindInitialize.mp4v.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\InvokePop.WTV.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tpcps.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonSubpicture.png.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Common Files\System\msadc\msadco.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\DVD Maker\OmdProject.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tipskins.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\DVD Maker\rtstreamsource.ax.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_SelectionSubpicture.png.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_ButtonGraphic.png.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\jawt_md.h.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Common Files\System\ado\msado26.tlb.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\7-Zip\Lang\az.txt.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_ButtonGraphic.png.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask_PAL.wmv.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fil.pak.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\kcms.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_SelectionSubpicture.png.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\whitemenu.png.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\vistabg.png.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe"C:\Users\Admin\AppData\Local\Temp\c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2348
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ed136c013e7868c52500db9a930954e7
SHA15d17da54b54198039f0feff300dd13ac72881e5e
SHA256910fce1a2a0408fb3ab6d4c8c2d693c1f29c83d435713e884782c993af7dcac5
SHA512b3038f1add3d2658a09a215af4a20d0469892d2f03a6b7ee18ae879af214090098da3002c027b8ee9f869a7ccdb3fffdc681e563fc44d84dcf62c2e320b3b932
-
Filesize
73KB
MD51c8e8d5587fc7425a37a89b9488f8192
SHA1faef18108d35567832e4df342c721c465fd40c22
SHA2564c599f258c080d85734335f5c49489e2d9c327e920441319464077e4c62b89c6
SHA5124bf424a159e956897fa7c0a55402fe6b0f1147e5ab1fb9868c8c476d495be4cbcab0feaa38150d3fc85231b3f3c3c640a84388cbca3fd70c409c48d0b8e15048