Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
12-11-2024 11:00
Behavioral task
behavioral1
Sample
98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe
Resource
win10v2004-20241007-en
General
-
Target
98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe
-
Size
79KB
-
MD5
74397bf8846297ea3dba8133887d76a7
-
SHA1
3145ee30874ae7dd1981cee8b42ababfbf1107cd
-
SHA256
98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088
-
SHA512
08acc2eb46f1c8d6a6b0da0dd4b1ba8d23a7378fa66a0941f2a16152ab0d07ef90e07b0d91e6904e97bbaaf757adb2ef3d448003868522e26b61c2e812f9424f
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATBHfBo8o3PHvQ9M:V7Zf/FAxTWoJJZENTBHfiPHYqvW1HK
Malware Config
Signatures
-
Renames multiple (329) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
resource yara_rule behavioral1/memory/1580-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x0003000000018334-2.dat upx behavioral1/files/0x0002000000010420-6.dat upx behavioral1/memory/1580-26-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exedescription ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\de.pak.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Common Files\System\ado\adovbs.inc.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\es-ES\MSTTSLoc.dll.mui.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_select-highlight.png.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\7-Zip\Lang\fur.txt.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\MSTTSLoc.dll.mui.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hr.pak.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_ButtonGraphic.png.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fr.pak.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\7-Zip\Lang\hu.txt.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\micaut.dll.mui.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Common Files\System\msadc\msadcs.dll.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground.wmv.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\7-Zip\readme.txt.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_specialocc_Thumbnail.bmp.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\7-Zip\7z.sfx.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSLoc.dll.mui.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ko.pak.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\7-Zip\Lang\cs.txt.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\micaut.dll.mui.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\7-Zip\Lang\ro.txt.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Common Files\System\ado\msado20.tlb.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe"C:\Users\Admin\AppData\Local\Temp\98b0e2f87106150efbf500539e8be32607a51e316a842fb8e336e037f6f00088.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1580
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
79KB
MD5221775d7762873dd02b2939ac03f193a
SHA1db4c5ba4f810c1db490b42345ab1993033e78680
SHA256dc4558dc18f5ed4303ea52b5dd3842dcdb159027502218c0a916ed48ce308d70
SHA51226628e17a3d47eced03c4af44d5387d7791bb1530982bc3cd5d3d4e74d748f4dfdf1a1e6b92808ba1f211a3bb49d0725b7cb93ec4cd4c3cfcc2b4b40a7024c44
-
Filesize
88KB
MD54a4db0c5e42983893a0eb4776ea1dc37
SHA12d26ab6dffd917e3361309b315efd2c3cb818584
SHA2562f0cf916fd604c9001d892423ed4800ccdd5a030102a588cf6c161978e4a6e38
SHA51207f7207c90afdf0486b443b9ac661b5548f20c0283e5ea1bae60be8aca41c872c0ee8f10155cdf991406be17a17d04232e5c5a67a5af741802a82c76b0f0c440