0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
Size

104KB
MD5

4bfc1ce2cfbe13da8e5e99199e989cdc
SHA1

06c38000283f3bbc6540ba2ddab423f5ec74df1e
SHA256

0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf
SHA512

6f5762846b4f78e60650fd3bccab582ddf1501bbdcc6904ddae08f8af29db4c279fb56e0484dfd4c47f297a5295f921834e86d77be97149b003b1967dff26fd3
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBL:PqFF2Ie+efsLv

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (598) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\net.dll.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\FlickLearningWizard.exe.mui.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_SelectionSubpicture.png.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Notes_PAL.wmv.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSLoc.dll.mui.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\jawt_md.h.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\npjp2.dll.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\button-highlight.png.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\DVD Maker\PipeTran.dll.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hu.pak.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jdwpTransport.h.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgePackages.h.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-background.png.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\DVD Maker\DVDMaker.exe.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_SelectionSubpicture.png.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ms.pak.tmp	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe

C:\Users\Admin\AppData\Local\Temp\0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe
"C:\Users\Admin\AppData\Local\Temp\0a08eed3afd87f5269b634291ccd4c8da01468d9ff90b17afa34951c1d1daacf.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini.tmp

Filesize
105KB

MD5
518b63a0db5b3591eb358394e3e22ec6

SHA1
1b6a9d5d97a9041346dc70dc705ad28577676498

SHA256
f5ef1dd6936cf62bdefe36db1ca51c903979d0ffc1280d2d6a07c7af62536e25

SHA512
2ce1e72355aba393ed4b68e631a7582b411e12e0f38597714b453eead0440621c4a7bd9c2ae3ca4ccbca7b7b1fdcd66e69f84fb03886ed2587998d911cc7615b

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
113KB

MD5
a12d18dd6188c0d7bb6ba1554e027b81

SHA1
9733227741102887af323ee54bf67f8592b0b196

SHA256
d090ca2a5202041c67de1fbfd8d6dd99226c4e9138e3d36f4727407a7e2fadef

SHA512
b6fd8a8bac5e7ce66b9eb6c9f1d91780d661d72769f6bf268b8863dbc12b2323f67e73534bed5cbba0a0676e426c7292201a65f433dd52df2d5100a9eedf6e3c

Download Submit