ecd70a0a114686b2b31d5af61f9dcbbd5f2687160ab344c0fe4524c03cf23d2d

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 14:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da8f988ebb8733fb11c8b85ebd15cb30N.exe
Size

49KB
MD5

da8f988ebb8733fb11c8b85ebd15cb30
SHA1

d81ac1f20b7401dd01765ede5de0e3cdc1424381
SHA256

ecd70a0a114686b2b31d5af61f9dcbbd5f2687160ab344c0fe4524c03cf23d2d
SHA512

2565c199b5ac4f0b8b657508cf1a3b25e33f6c93add49af6c8a23f4b9ddfb2916dadbeaf83082e046b3965a24c7e7ddbbb4219df3c81406f91ae1892e7bebade
SSDEEP

1536:W7ZppApcZ/D5zf6ydyf+abMkF24kzK3jbrCkoRWNkzZ/D5zf6ydyf+abMkF24kzD:6pWpcZ/D5zf6ydyf+abMkF24kzK3jbrQ

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (337) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveAnother.png.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\msinfo32.exe.mui.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\MSTTSLoc.dll.mui.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\7-Zip\Lang\he.txt.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG_PAL.wmv.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bn.pak.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_SelectionSubpicture.png.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ja.pak.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_ButtonGraphic.png.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_SelectionSubpicture.png.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InputPersonalization.exe.mui.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-BR.pak.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Common Files\System\ado\msader15.dll.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\DVD Maker\OmdProject.dll.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\DVD Maker\Shared\Common.fxh.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\d3dcompiler_47.dll.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonIcon.png.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\ImportPing.wma.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	da8f988ebb8733fb11c8b85ebd15cb30N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	da8f988ebb8733fb11c8b85ebd15cb30N.exe

C:\Users\Admin\AppData\Local\Temp\da8f988ebb8733fb11c8b85ebd15cb30N.exe
"C:\Users\Admin\AppData\Local\Temp\da8f988ebb8733fb11c8b85ebd15cb30N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
49KB

MD5
e2f43f899ead7da97febea49adaabaf7

SHA1
6ab05029fff79f69724624a4b0e967916676b222

SHA256
8c81021faddac7dfe8b7403f9b02e6b90062056ace40a0b92e7086b6db3a0f51

SHA512
aa6125d507a704a5b53fd51e9f5c560b46b184e98ca9ddf5eb5127754b1372d2668663fca31ad6e69090c9d182e233817e8ce4fafe843a1ed5824ad7dae47b81

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
58KB

MD5
fe8d55be623b26c4a93fd0c9a8a0ad0a

SHA1
95064f5d36c7975e7eaba74b5426eddee50926d9

SHA256
330627cfc8b5723e11b3b6f9c736919644a6beaedf44282cf2f828b323d777f5

SHA512
db46eb4df22de5aff9ef3c0dad397bccd5e21f43afdc1f11f85917a8896232b766167bd59ecbe4131409d8c0e64486c3256f3a54028df637adb757a8d25a74d6

Download Submit