0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3

Analysis

max time kernel
151s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 18:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
Size

205KB
MD5

aa02264343d1ae77898725564e295d81
SHA1

d45c7c14a8b60b19b1d89ae75b0df325983e4877
SHA256

0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3
SHA512

d9b04d629add0a4b9d919f1d82b7120fe0f67ed72efef4bab071e36f49feed23612ec45d840444f86a3f264cf70a171f963b7295d00570c536655bdab3ad9a3c
SSDEEP

1536:W7ZQpApfytyxsks0DjdesgHOsXOHepOHeP:6QWp1sksHsuOsl

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (291) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\7-Zip\Lang\he.txt.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\DVD Maker\ja-JP\OmdProject.dll.mui.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveNoise.png.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-PT.pak.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\7-Zip\Lang\ne.txt.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\7-Zip\descript.ion.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkWatson.exe.mui.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\7-Zip\Lang\pt-br.txt.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\DVD Maker\Shared\Filters.xml.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\DVD Maker\ja-JP\WMM2CLIP.dll.mui.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui.tmp	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe

C:\Users\Admin\AppData\Local\Temp\0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe
"C:\Users\Admin\AppData\Local\Temp\0a2652cd5566d9d86dde6a6acfda0afaf0f9c2c4186338f05412ed5540f761f3.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
206KB

MD5
fa4889b3cfc05fd014e42bdb1d4db742

SHA1
63e609e008c6c16d13cf3452857ce46243ed9e2a

SHA256
6b7c18b2fed9ea87142507810ed573fa5b126c58c71b5fe366172b121651ce9a

SHA512
d295c7d3344ddc0f63941bf620ebf1b012b02c78f47f34394eddc9e36a5d15602a0788e2e506d858424ea79d97bb47b9588f79b832d980fbeb12cf941a7a5d85

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
214KB

MD5
326ef2e3a42ca1e9652f01c969f87abc

SHA1
db3c0e3dc3a30a869ccb9b3bcf139d02c6302166

SHA256
4a5f165cb696c704c43874ff0d881a6fc13023e4e8ab96d77f64494e1315401d

SHA512
4380dcdc193eac39f3a1dd72920683878a07c584166f9e76d9da7a6f8556616506949ab9198fc7d48692e812bd7bdd7855fb980629647c609a1793b2570052a6

Download Submit