22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 20:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
Size

78KB
MD5

ded9d23ca0e1009c283d32a90b8ef070
SHA1

1b34ae6bfe314de311ea674e617f08f9bd729c96
SHA256

22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9
SHA512

16c8eca21e77ee602395b2259184c327163c1d67c6adb33aa7d597b13a51c82f9dac4ed2ab4c553f8e71757575d5e6168a9bc080ed6163d4f8ea330409936902
SSDEEP

1536:/7ZQpApze+eJfFpsJOfFpsJ5DVSWu0SWudVI:9QWpze+eJfFpsJOfFpsJ5DVSWu0SWuQ

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (336) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\co.txt.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\micaut.dll.mui.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\el.pak.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_postage_Thumbnail.bmp.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\DVD Maker\Shared\Parity.fx.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\DVD Maker\fr-FR\DVDMaker.exe.mui.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Internet Explorer\en-US\F12Resources.dll.mui.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\micaut.dll.mui.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpn.dll.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tipskins.dll.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport.png.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576black.png.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fr.pak.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcfr.dll.mui.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe

C:\Users\Admin\AppData\Local\Temp\22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe
"C:\Users\Admin\AppData\Local\Temp\22cdddd4ae930e31d0fb3ffe717aa7edef2aaa439eb37457c31e37a91f6882e9N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini.tmp

Filesize
79KB

MD5
426df815abc520d8246782ac095d9f20

SHA1
8d1ea2c7b08b9377ac81f61b8588aa0cfdbcdd1e

SHA256
d68a6fa7c613214c5d92db2228e96d9ddb2f73a575e12564e5747220bd7dd45c

SHA512
15a3efe49ccd3e459d391decd87371c01f1669e35ebcb46f917a79f6602ea252e061e73b47e913a6807f9ffe6ab7666d0d8a2ba5d80d9fe89c074a2d4ade5cda

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
88KB

MD5
74c95e891c99a6f076f3f66eb17e4bd1

SHA1
bdd04f47bb850054c5c98db862d0566cff20827c

SHA256
937bdb4802ed6a03d929c972ddb2102a08704a0346756738bac4185dd18fb871

SHA512
7a697007a7debe525c3df16c47c488f56ababdca72c768a753a0aff93b62ea8c89ea368aa3decf4f0b70a1262042f99f8205c8865f0140fae1bf13bc223467ba

Download Submit
memory/2056-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2056-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download