aac367ebb0a7509c9005ad105631f7d908e1be09f1882b85e0c50cc44de9a73b

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d123016c1e146edbce54643e4d03db0N.exe
Size

72KB
MD5

1d123016c1e146edbce54643e4d03db0
SHA1

3fdb3a4d94ab8b67e366529d783a7fe7300ae92e
SHA256

aac367ebb0a7509c9005ad105631f7d908e1be09f1882b85e0c50cc44de9a73b
SHA512

1b0894508788bfcbd8fdf6263d856d2415014d1cf2ac6c922aeae7694b9c03b9c6ec2a464a6816ec67c6aa5c9eb7b32258bd53280273158ff9b0385ca55c2092
SSDEEP

1536:p7ZhA7dAp1++PJHJXA/OsIZfzc3/Q8Lv057:Te76WQSo6vs

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (304) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcs.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-highlight.png.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\DVD Maker\rtstreamsource.ax.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ms.pak.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\DVD Maker\Pipeline.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-CN.pak.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_SelectionSubpicture.png.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576black.png.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mip.exe.mui.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fa.pak.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\System\msadc\msadce.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\DVD Maker\Shared\Common.fxh.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\optimization_guide_internal.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\System\ado\msado25.tlb.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	1d123016c1e146edbce54643e4d03db0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1d123016c1e146edbce54643e4d03db0N.exe

C:\Users\Admin\AppData\Local\Temp\1d123016c1e146edbce54643e4d03db0N.exe
"C:\Users\Admin\AppData\Local\Temp\1d123016c1e146edbce54643e4d03db0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
72KB

MD5
de0df9ac9762c74f3a25eb1f46802211

SHA1
a03f050c2b9585eec672d31be69fe4f82e789167

SHA256
1d4fe89edd3d68d54c867511030e08ed33120fc4f3981a040e3e3725afffc392

SHA512
ba595b4fd7c992c6a074df8f3281059e8d8c740fa82998f1890bb069e4af79188a1a81e8be2c09cb500aec17cb24ceadd26ff60a1672213bd1e075207257b025

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
81KB

MD5
4d49bdc125311c388ac21ee638293451

SHA1
5ebaecde702e6eaa69f4e267d1b7ddbe44c1dbea

SHA256
74ef283437b44b83d4350bc8a1c2f7ed99f977481c1561af274381d29088efc7

SHA512
35978404e87bf32d4a624329afaeefb603127c7e3d8065fe317dd16dc1763eef29e7429b92ab5dfe143764c568c7d4423b707c45c4223580a4e0b1ca6078162e

Download Submit