4d09a9ca422124d186c8983a2081a56610d95d4ecd3bf1c818a8473e3637072d

Analysis

max time kernel
121s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 00:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d8ac6a40bef3c7cbf3494dd31575590N.exe
Size

70KB
MD5

1d8ac6a40bef3c7cbf3494dd31575590
SHA1

fd7895724f06609a5b378c63f790b9b7789182c3
SHA256

4d09a9ca422124d186c8983a2081a56610d95d4ecd3bf1c818a8473e3637072d
SHA512

05ee7b74a91ee22049a03d0478b0ea2e7792cc13ed6382def8af09bd1df41a7697b408320868c3c723379985dbc0afc2d9997240ff5260ae369e0534e4e8fc48
SSDEEP

768:W7BlpDpARFbhYQkQzaxkd+axkdo176/hvYaJaMGw4PCs2B24PCs2BHE4JAIAepEQ:W7ZDpApYbVK4vx4PN54PN4OHepOHeZSY

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (338) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Common Files\System\ado\msador15.dll.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Google\Chrome\Application\master_preferences.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\DVD Maker\rtstreamsink.ax.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_ButtonGraphic.png.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\DVD Maker\ja-JP\WMM2CLIP.dll.mui.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\de.pak.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader_icd.json.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Internet Explorer\en-US\jsdbgui.dll.mui.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tabskb.dll.mui.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\7-Zip\Lang\pt.txt.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveNoise.png.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\d3dcompiler_47.dll.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\DVD Maker\directshowtap.ax.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sw.pak.tmp	1d8ac6a40bef3c7cbf3494dd31575590N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1d8ac6a40bef3c7cbf3494dd31575590N.exe

C:\Users\Admin\AppData\Local\Temp\1d8ac6a40bef3c7cbf3494dd31575590N.exe
"C:\Users\Admin\AppData\Local\Temp\1d8ac6a40bef3c7cbf3494dd31575590N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
71KB

MD5
f8aa4fd31934c67cb6235404e7215e67

SHA1
bfdd53cb1deef0cc83562a94b2d9420ff9b11546

SHA256
336cda679bc509d2a5d03d4abd3db1aa46cfc0c5a3c1ca6bd457e2c24f03f41c

SHA512
0c23dc7a5737215266853904eec431d29820a77852adc92e9089e43e1b7eada305a6581d2ead283287e59d8671db07c7fef5b4984039f531cdc31b526463e418

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
79KB

MD5
7254ec2fd23c698e7b065610f86582a6

SHA1
0c012ec42f84f4ff5c4046c81235f38ee0335a50

SHA256
7a7b7e166e7cf39f7820561fc811d51a7d5291a1318e5e1b0c356ccc945bc261

SHA512
21cb114b262e925292c0ac05323eb042a3d3e8eb9b2cd1217132ba3dbf53d864dee4117c8d8873b88fe86524e8775215949bff1ff2283ed2f315ea281da18205

Download Submit