ea5d5c2cdda7962ed5aa069742b81dd3b462ebc84faa99c79e4d53458dcd3367

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 02:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8056a12c8fc1c06a324cc702c075cc30N.exe
Size

68KB
MD5

8056a12c8fc1c06a324cc702c075cc30
SHA1

91ea37bc71e01cb1c1f0664f1a2808a23c6d2528
SHA256

ea5d5c2cdda7962ed5aa069742b81dd3b462ebc84faa99c79e4d53458dcd3367
SHA512

2984fc1b6d8056052fbef38e81e1b093374c2883c6cb10ecb5cfab09e84afa5b32934bb2f63188f588c4bfc1db840262811e742ac80460c3941243a4521a0b49
SSDEEP

768:W7BlprpARFbhJ68nNIreUYEreUYX1n6mQmB/0BCTBCgPn:W7ZrpApJ68nNIreUvreUun65nMTMgPn

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (319) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_ButtonGraphic.png.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_highlights_Thumbnail.bmp.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\blackbars60.png.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\Shared\Parity.fx.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\GetSuspend.svgz.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hi.pak.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_SelectionSubpicture.png.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576black.png.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcfr.dll.mui.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\cloud_Thumbnail.bmp.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\203x8subpicture.png.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_specialocc_Thumbnail.bmp.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_ButtonGraphic.png.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\7-Zip\Lang\he.txt.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_ButtonGraphic.png.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\uk.pak.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\Common Files\System\ado\msado26.tlb.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\OmdProject.dll.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\kn.pak.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\de-DE\OmdProject.dll.mui.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\audiodepthconverter.ax.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveNoise.png.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\te.pak.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\PipeTran.dll.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720_480shadow.png.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mip.exe.mui.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.tmp	8056a12c8fc1c06a324cc702c075cc30N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8056a12c8fc1c06a324cc702c075cc30N.exe

C:\Users\Admin\AppData\Local\Temp\8056a12c8fc1c06a324cc702c075cc30N.exe
"C:\Users\Admin\AppData\Local\Temp\8056a12c8fc1c06a324cc702c075cc30N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
69KB

MD5
32f45c93cffb82636a3863e2f3f2d30e

SHA1
2c766a729aab3f9c2936d786aebfc3c39a3e782e

SHA256
0fe5c8a59fc8e1f19a635bab9c7961070bc5e146cde82d9bec39800d09569408

SHA512
65a9007c5d7252911c316db61cf5e839e2af33064f85723bfa517b20d70c6f06c910f7bb433fe25bab6080f6ca809730946115317dae8c3068965fb2bfbc1fa7

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
77KB

MD5
c2c02bb1665b9a77172dc06a6e73f60c

SHA1
54ae17d333c24f6b6eee91fa34879cfe5bb20281

SHA256
30c728f89141fd0f93de3c319651ef2f510329eea4e56153229f981af86e5b99

SHA512
1cb674ff25229f03c20f7dc88bb7d51eda1920650b14f5ddd2c7bbd2f14e5258be4cd93acc634e70dbb78b9ad2fd7247489299d9307eddef09c2fcfb8d03cd75

Download Submit