e955af7c49b1548edaa781f60ae8dfcfeac1a5a624c4b0f771e0795f01bd61ac

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
Size

50KB
MD5

2e5eaafdfb958bf3f6a7f2c3672ed030
SHA1

0cfde6059a8baf47a5d2042bb3637959b89ac46c
SHA256

e955af7c49b1548edaa781f60ae8dfcfeac1a5a624c4b0f771e0795f01bd61ac
SHA512

a0f02dd9c9f921c0d47d95f873ef4ab9945926c0be05bc2f23c702710a8736f8cefa66b6d27ebf5229ca95aa9637dfb7ad8191dd36499fe87ac34bfa7beb5e0d
SSDEEP

384:GBt7Br5xjL9A7AgA71FbhvnIH2YsTKnKqtaW3WaEdW3WHY3SjSGNT:W7BlphA7pARFbhvOsTKnKqtkYi+GNT

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (331) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\MSTTSLoc.dll.mui.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_mainImage-mask.png.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\DVD Maker\de-DE\WMM2CLIP.dll.mui.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref.wmv.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ar.pak.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\gu.pak.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_SelectionSubpicture.png.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcf.dll.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\DVD Maker\audiodepthconverter.ax.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpn.dll.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_ButtonGraphic.png.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrespsh.dat.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcfr.dll.mui.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresslm.dat.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\MSTTSLoc.dll.mui.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\System\ado\msado25.tlb.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fa.pak.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcfr.dll.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\203x8subpicture.png.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2e5eaafdfb958bf3f6a7f2c3672ed030N.exe

C:\Users\Admin\AppData\Local\Temp\2e5eaafdfb958bf3f6a7f2c3672ed030N.exe
"C:\Users\Admin\AppData\Local\Temp\2e5eaafdfb958bf3f6a7f2c3672ed030N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
51KB

MD5
06d2c51b8c71743ad59389d0f0a358f5

SHA1
2c6445673c5d21e69edf5ad35af0e02ad4c27f33

SHA256
bddf188ba804d62f47539f27239fac065584ee2b3010c39f356ed7102d1c54b4

SHA512
d2b6b7dabed30cb9087164aa17b1b34d7a426b8ddcbbf03ee19a344c151e4b91856df5e03c5f556407719ba69c699c366ab13de78cea126f63cf050376de5dae

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
59KB

MD5
8e26ef3c238ac2f0316bc5b251108488

SHA1
485851d87b93ffb3f458cb2cdb9d467c5e2a75e4

SHA256
50b500ec0eee12c919dd627335b5726041a7f3ef981ba83a361226e5c16a0033

SHA512
0de64eadd9519971e88ed4cf4916126d71d593f987ad075cb8b3501a66771376c5b510311bf1c24804e0d6bd54315240068fb8d57786ef11efb27b267e68d57f

Download Submit