833c31e58b459058b6f5aa0588454a2c28854242aa9a5f45d287a4a9cd990ee7

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24-08-2024 06:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e58e52eb424c20f49307c6912d1cea60N.exe
Size

238KB
MD5

e58e52eb424c20f49307c6912d1cea60
SHA1

0e10fa6b548e589fcb45ddb3afc18737d342e345
SHA256

833c31e58b459058b6f5aa0588454a2c28854242aa9a5f45d287a4a9cd990ee7
SHA512

74656e5d742caf7891b5c7703d27ad713d3de123143ce3432ce5e631ccd7dd3cd0225b5c6515d8c9b8448a9bdfc15f4cb432771e2ab02c0121da5e91062c8e6f
SSDEEP

768:W7BlphA7pARFbhKKVeIuKVeIBt+OKObYhnKhnZS+2w4Vqx0VqxzFtF2TZpe:W7ZhA7pApBt+OKOsZKZZSjw4Vc0Vcye

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (227) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\header-background.png.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\1047x576black.png.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\micaut.dll.mui.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\Common Files\System\DirectDB.dll.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\DVD Maker\PipeTran.dll.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\micaut.dll.mui.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-background.png.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\ShapeCollector.exe.mui.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-previous-static.png.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\layers.png.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\scene_button_style_default_Thumbnail.bmp.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\7-Zip\Lang\hy.txt.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask_PAL.wmv.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_SelectionSubpicture.png.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll.tmp	e58e52eb424c20f49307c6912d1cea60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png.tmp	e58e52eb424c20f49307c6912d1cea60N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e58e52eb424c20f49307c6912d1cea60N.exe

C:\Users\Admin\AppData\Local\Temp\e58e52eb424c20f49307c6912d1cea60N.exe
"C:\Users\Admin\AppData\Local\Temp\e58e52eb424c20f49307c6912d1cea60N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
239KB

MD5
adb120b188e443142f1885d759cba2e6

SHA1
ab60735584c0ed8075b7d858ff21802f498ec456

SHA256
8d5badcc6d2db1333df18477761075ba026b9da41f989ca9dd7a3297e3dddd9f

SHA512
5aff96973f4dee253afe7ff476882f0d02775536574ced2736c3eed705e8add625487c9b1f5e950cba58d562221d5ddc9f4b0c1f9a443c16aa1e836f7a62017e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
247KB

MD5
84e5bfa55586b6e48167c006230cf721

SHA1
e6c0d616133b289658aa89e23da9e8e7ed606506

SHA256
445bc0e28f7fd43cf1102a6f053edf7dd63b51cef4636345fff977318f0f0d90

SHA512
ea78d729da4d2aa2a6e06fb3768fc61445734afff496b4e8c62fd9870796aee1e5839dc8092082717fcd9d224aeff9bd2e03567ee2211772650a0bae917c69ee

Download Submit