4f9248d3b8d44c96828c766aaa0a804417847cb51065da9aec587df062db311f

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 23:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a1aeed0a33a263ec6e7c5f9e7c466850N.exe
Size

53KB
MD5

a1aeed0a33a263ec6e7c5f9e7c466850
SHA1

e3e447e76329d30f0ceb968e91915b6165d19c38
SHA256

4f9248d3b8d44c96828c766aaa0a804417847cb51065da9aec587df062db311f
SHA512

2863624f7308da9e7dd561151d28bb497b4a529ef8d532d515b0c9eb76069205921c7b39f0eedb1db7a6c1563f5f38c88c9b4b6f983ccad078ebca606605525a
SSDEEP

768:W7BlpppARFbhjbhQYjY94OK5c5gYcUYcfnyIG6tnyIG6FTpTK:W7ZppApBE4p6WYcUYcvLG6JLG6i

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (332) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\BlockBackup.aiff.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\micaut.dll.mui.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_ButtonGraphic.png.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\7-Zip\descript.ion.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\tipresx.dll.mui.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\1047x576black.png.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fil.pak.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\Internet Explorer\en-US\jsdbgui.dll.mui.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tabskb.dll.mui.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSLoc.dll.mui.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_SelectionSubpicture.png.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask_PAL.wmv.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\7-Zip\7z.sfx.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sw.pak.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\mr.pak.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\CloseSuspend.docx.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-over-DOT.png.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\whitemenu.png.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\th.pak.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\MSTTSLoc.dll.mui.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\mojo_core.dll.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\7-Zip\Lang\en.ttt.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIcon.png.tmp	a1aeed0a33a263ec6e7c5f9e7c466850N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1aeed0a33a263ec6e7c5f9e7c466850N.exe

C:\Users\Admin\AppData\Local\Temp\a1aeed0a33a263ec6e7c5f9e7c466850N.exe
"C:\Users\Admin\AppData\Local\Temp\a1aeed0a33a263ec6e7c5f9e7c466850N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
54KB

MD5
04eed0e385d6d1120c5500b3191f2320

SHA1
731364fbd75efde41597ebf3dcc3fdcd60dc6653

SHA256
0d469302bd2361991faabf850ee711e58eab64c2eeed589bc2bbb4e408fe8d6a

SHA512
ed06f8c952b67351144bdd780cb76652cbbcfb339379932c1ad42dd429576c8cf4a981d42412510364546ff3746fba43df22cb45be6567ab19aaeb45f6f7089b

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
63KB

MD5
3eb666e2a5cbb2dec6887c9399725c0d

SHA1
941bf7c04d9bee7cc32aacbe6eca383704958be0

SHA256
2b96bcde1973a5fab8e4bf54f810ab69874850ca20e47bea437a73f7f3525f30

SHA512
52c667fc24182ddc97798f49e71d036e9263ea3c9dd18c6b6b4432163ea6eec3d528d40888bba41b986551545f2fde9318657b47697af631bd5c195a08e77ecb

Download Submit