33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a

Analysis

max time kernel
150s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 20:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
Size

297KB
MD5

b439810f6d2fe7796bc124edc3bc84ec
SHA1

32314523f25e9dbd069f8b3acf88452b27778d28
SHA256

33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a
SHA512

43194e2d13a7dfa78aad0c8afbb4982aadfa3b89b13a97e7f6e24f97ca3bb7ba1fc9f27e6f2dc8af77ee633c2d644d39699c20825ed6f440703e61065c1a6950
SSDEEP

1536:W7ZhA7pApaX0aX09rDVMFDwU5LenTpnDr5LenTpnDRSfuYa3bztYtzZrZotYtz1H:6e7WpGlCK1I1H

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (270) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_widescreen_Thumbnail.bmp.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveNoise.png.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576black.png.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrespsh.dat.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-over-select.png.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\DVD Maker\Shared\Filters.xml.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkWatson.exe.mui.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\DVD Maker\de-DE\DVDMaker.exe.mui.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\DVD Maker\es-ES\DVDMaker.exe.mui.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_ButtonGraphic.png.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\7-Zip\Lang\fi.txt.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_ButtonGraphic.png.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_ButtonGraphic.png.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\CircleSubpicture.png.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tabskb.dll.mui.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport.png.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
File created	C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe

C:\Users\Admin\AppData\Local\Temp\33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe
"C:\Users\Admin\AppData\Local\Temp\33a3c07d59b37c8d3c0fb5f0740048cf4fdacc382bdb3e6804d0dfd5d062080a.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
298KB

MD5
c315a1d4b20cbe77c897677cee4224b5

SHA1
8d059d0227fe63ce760109d3159855d1df672406

SHA256
1b72f6069d6c4e78d2b9af84a61adb530fbf82983a65ae2c166cc41386819718

SHA512
f60d7eba5135a2892fdfcaacc275c5133ce3c2d32bbff6c2ea67790f93a5deab8d8c7946929f4a4e568f7cf6efb10a43654aa1492ba0bc51e0bd1a26be969d4a

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
306KB

MD5
bc59c4d6f939a207a0f5f8b5d9fab8f9

SHA1
2fcd5683ea5dd8413cf87a7967fbf641f307fd20

SHA256
8e840bc1ee8059d0b3bedc0db272ceabfb40b5576968b17db528b871dd499e42

SHA512
0fde4d143db479f13b15d44a611e92c67c9759fee768005da7e29cdcfc0eaa4b082d5aee5233fd35d0a14c47e2f202675e4340767ea6463f44e9f035e22aa11b

Download Submit