a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c

Analysis

max time kernel
150s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/08/2024, 00:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
Size

68KB
MD5

e006812a35736ab32b116583b216842e
SHA1

9a1b193a6b485a58a657d31c8fee05e3c9407a4d
SHA256

a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c
SHA512

5cf3e2c8c380d4edd6901e39df75d72214a1ac3c54da42d7427cef538a67532153e0477b086011bdfdef8b0c0de2702e1aca64da10448afec6355f7cddde79eb
SSDEEP

768:W7BlpppARFbhbt7Y7WBp9/Bp9S9dr8WbTr8WbV:W7ZppApRhS9f

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (649) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tabskb.dll.mui.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ja.pak.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.policy.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipBand.dll.mui.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.dll.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunjce_provider.jar.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Internet Explorer\en-US\eula.rtf.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ko.pak.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\COPYRIGHT.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Common Files\System\ado\msado25.tlb.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\sRGB.pf.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_SelectionSubpicture.png.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_ButtonGraphic.png.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\th.pak.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_CN.properties.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Juan.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\DVD Maker\DVDMaker.exe.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_select-highlight.png.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\MSTTSLoc.dll.mui.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\ConvertToStop.mpeg3.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssv.dll.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\DVD Maker\fr-FR\OmdProject.dll.mui.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe

C:\Users\Admin\AppData\Local\Temp\a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
"C:\Users\Admin\AppData\Local\Temp\a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
69KB

MD5
59555782fc90c1a066fa1cf701841119

SHA1
0c4eaff148b12c44e5b6b1b9f23aaa279dcd3baa

SHA256
cef89dc15572a8324b0f68ebc0376dcef3712d82575d6c2feda73b728c2a0cdf

SHA512
8cafa608664767b6a2f61b008ccae7197b522fbed289e6cc558107bb0c951936b82bcfd21453e81bc60be4ce86893794f6df702a8a992f2c35b217c9ef351988

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
78KB

MD5
dd4db18621483fe83fd41033672c0965

SHA1
bb15146a3a5cb642ad32bb5d4f1a58594f8a5a8d

SHA256
db91026ed4d9716f6f7ba010be5ff2e2767f5beafa4ffa944ce29c8f95d6cf1a

SHA512
c5e41810b5a7d230213fd6643b14e86410937953bc5dea748c54e3e2bbbfafb99623cdbf2c5d5895fe46dbafb95803da5093c2197b6081f20da99e7c5a9b3fe2

Download Submit