fd44014c1d78cad1164200f586e63357310ef78ace0227eab353181d284ce9b3

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65a044ab3b33952b9f09f7baafc8b620N.exe
Size

48KB
MD5

65a044ab3b33952b9f09f7baafc8b620
SHA1

3e1bd2e810b6e822107441a11c0930c72b953c25
SHA256

fd44014c1d78cad1164200f586e63357310ef78ace0227eab353181d284ce9b3
SHA512

65a2c2e022c6998b920f307989b4a6e2266d22c293cf1bef600ec0b2830d65c5439be281f3254f9224e7211c6afcef979b33ecc2111bf9937a0663ab1ee51823
SSDEEP

768:W7BlphA7pARFbhL801VvM801VvcR2+lJtZ2+lJtSsg3/3Zr:W7ZhA7pApw03vR03vcltdtSssr

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (370) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mip.exe.mui.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IPSEventLogMsg.dll.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\rtscom.dll.mui.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\Internet Explorer\MemoryAnalyzer.dll.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bn.pak.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpnr.dll.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\desktop.ini.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\DVD Maker\fr-FR\WMM2CLIP.dll.mui.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitevignette1047.png.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask_PAL.wmv.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref.wmv.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\cloud_Thumbnail.bmp.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe
File created	C:\Program Files\Common Files\System\msadc\handsafe.reg.tmp	65a044ab3b33952b9f09f7baafc8b620N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	65a044ab3b33952b9f09f7baafc8b620N.exe

C:\Users\Admin\AppData\Local\Temp\65a044ab3b33952b9f09f7baafc8b620N.exe
"C:\Users\Admin\AppData\Local\Temp\65a044ab3b33952b9f09f7baafc8b620N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
48KB

MD5
92a9707c241d794ae6f5b9f46eda8f19

SHA1
e1a55069047c0afc804431c9b0f7221f86d948d5

SHA256
f2f5fabf28ed6d1c61c648de8823f18173e3dbc57b7928662b2df88678a916b4

SHA512
ec85a30f6382e0501c67420fdd87fe7ed1c75dbea5acc60064ff413dcce8011c3887d9d7b56f08f9a7f542f98a4e969ac4e91791ff188abfe54cdab3090ec9bb

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
57KB

MD5
5c51d4d74f5eaf77e84afdcda5658f17

SHA1
c7fb79aac3420d1898030b10aaa2b685883ff945

SHA256
60a039891860d08892af917b1ec107a03bbf2495fa938b462b21d4c1841e0e79

SHA512
70ec719acd4409570e8ab76cc0ed3c31119a41756120ee1e85f5a3f8bb80c041e52125aa584fd4d9d9a581472924877547d7980b372eef4455f8e30aa1c5a2e3

Download Submit