e75c53f4c0c9e45997ff3cca907ee523e9970ed5e1e4038ef82353b41dabf0f7

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 05:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c2832d4d0d9f356a20bc35b684e3300N.exe
Size

2.3MB
MD5

5c2832d4d0d9f356a20bc35b684e3300
SHA1

6f9edbe1d74fc0adb1aa6ce99a0a35f747dfc89f
SHA256

e75c53f4c0c9e45997ff3cca907ee523e9970ed5e1e4038ef82353b41dabf0f7
SHA512

39cd11fbc584e53f05a4867b422af5da33e62261a23c206af053a3a2590ac55a494bf6ae115fc0a37f7f7c115be09208a1133d836f521683fb6b3b412f86e2af
SSDEEP

49152:xJWQFoNRlYmCEruP5m9lMJWQFoNRlYmCEqv:x08oNRJX9lM08oNRsv

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (226) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipBand.dll.mui.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\MSTTSLoc.dll.mui.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\DVD Maker\es-ES\WMM2CLIP.dll.mui.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\7-Zip\Lang\hy.txt.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\DVD Maker\ja-JP\DVDMaker.exe.mui.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground.wmv.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\System\msadc\handler.reg.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpn.dll.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe
File created	C:\Program Files\ConvertMeasure.jpeg.tmp	5c2832d4d0d9f356a20bc35b684e3300N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5c2832d4d0d9f356a20bc35b684e3300N.exe

C:\Users\Admin\AppData\Local\Temp\5c2832d4d0d9f356a20bc35b684e3300N.exe
"C:\Users\Admin\AppData\Local\Temp\5c2832d4d0d9f356a20bc35b684e3300N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

Filesize
2.3MB

MD5
471d86b425c04ed5c2310a06109268c3

SHA1
b2357632be464091f4712191b9201f298d033b74

SHA256
aca54adf498b75882f77a37fd37a54450c72e144b9e7a95afcd42c2c53b09b31

SHA512
1f50501937fc76bb690f11e18cf5932950cdc872400be528e3cf13a4684ae52d590ccce487c79909840329bb76d2b75fd9f1d944472abb4026e1549bdea8a054

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
2.3MB

MD5
1585aba25bcf9f03b2fc0fcc44a38af7

SHA1
a0894897d86d5d47dcc42905ec729c5ea6d5a5b3

SHA256
f1907e2868d724f4b3203a458ef7809611f8c806b00c500ac674d37f8c9a6bc6

SHA512
da6bbe92a760c9073edeaffe91d2e2519ab19faef412469001bf6f095c4f380aa75eafb88a793001e8c06cc6112b78e67a163d39c57e751a0c430c50cb19a402

Download Submit