Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
24/07/2024, 05:56
Static task
static1
Behavioral task
behavioral1
Sample
5550bd13fbf2ebbd6ea9c84acd348020N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5550bd13fbf2ebbd6ea9c84acd348020N.exe
Resource
win10v2004-20240709-en
General
-
Target
5550bd13fbf2ebbd6ea9c84acd348020N.exe
-
Size
53KB
-
MD5
5550bd13fbf2ebbd6ea9c84acd348020
-
SHA1
15a5b84b35109ba0dd75ef5d56b3ba90fc945e94
-
SHA256
f4f616aa8bc95842df249686fce81c1c5214c3c9b8bb38b70bc7640f1454dd04
-
SHA512
989824893e9904bef65009265d69a3f328ac1c493b651c1cdc09fcc7ebf929782f5f78b8a8825335908142c413f515ccfc07d6a61eb567d0caf3a8ceff06e6b2
-
SSDEEP
1536:W7ZppApB7tlJ5OvtlJ5OwF7CujdyGdyMMkPMkYYL:6pWpB7tcttFOuR
Malware Config
Signatures
-
Renames multiple (312) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\msinfo32.exe.mui.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcfr.dll.mui.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_ButtonGraphic.png.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\7-Zip\Lang\nn.txt.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\OmdBase.dll.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_ButtonGraphic.png.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_ButtonGraphic.png.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Notes_PAL.wmv.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\7-Zip\Lang\it.txt.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\7-Zip\License.txt.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tpcps.dll.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-BR.pak.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\ExportConfirm.wmf.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\7-Zip\Lang\ar.txt.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\7-Zip\Lang\nb.txt.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\7-Zip\Lang\tk.txt.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ro.pak.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\7-Zip\Lang\lt.txt.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_SelectionSubpicture.png.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\shatter.png.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_100_percent.pak.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_plain_Thumbnail.bmp.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\1047x576black.png.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\gu.pak.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe File created C:\Program Files\7-Zip\Lang\ga.txt.tmp 5550bd13fbf2ebbd6ea9c84acd348020N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5550bd13fbf2ebbd6ea9c84acd348020N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD5b9743599d74beed811dcb19206157c3d
SHA19a691dfaf73645b56861b9d97e2bf061e6b8a4b4
SHA256d511b24bea82cc891d6b9a7a7e0b9ab55275daa866fa668bd1ac126df0bcdb88
SHA512f57f235b92eee16635d7ffa3719d877b241c20d877b6805223f603589fe901df0c011e76ce2c8961c7cc1e6159b2ba4bde21ebb6817ad62cf55d44735174f961
-
Filesize
62KB
MD588ada116545257d058460e0f711101e8
SHA10e8f16a9e010a5551838f915e2072e3b3af0c8d5
SHA256d87b14b4f89faf2be1f5233055b933bcddc763c7d4146a0691496c57ca2a09ce
SHA512f66c18897f050af34f32577bbd7373d5b72d1f468d9b020220aba57c0128f3093ca07e040ba8478ff622ef6314b53959143c7713bb04f21e28a137e8e0b744aa