5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254e

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 07:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
Size

90KB
MD5

8b2169ab7c5095c9681de94defcf4d10
SHA1

0d5cb489f49b958469f3c40fcca748c1362db100
SHA256

5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254e
SHA512

819ceb5a497882931c97822e0d883b6ca3e484a4720be31b485e569967c323618ed0797a55f806476dd7375ec6b48abaee7d767019883ebbfde66596ac1b2b75
SSDEEP

768:/7BlpQpARFbhiWb8naOnaBGNS10w2Yw2l+Y:/7ZQpAp/Eaiax1n+Y

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (333) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\MSTTSLoc.dll.mui.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ms.pak.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipTsf.dll.mui.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\de.pak.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sl.pak.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcfr.dll.mui.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\vignettemask25.png.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\optimization_guide_internal.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hi.pak.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipBand.dll.mui.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoBeta.png.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpn.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\DVD Maker\ja-JP\OmdProject.dll.mui.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_100_percent.pak.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\DVD Maker\it-IT\DVDMaker.exe.mui.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tipresx.dll.mui.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe

C:\Users\Admin\AppData\Local\Temp\5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
"C:\Users\Admin\AppData\Local\Temp\5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini.tmp

Filesize
90KB

MD5
ae7766deebf16845f8367861714b31e3

SHA1
be79c47dae996f25529640cc04b38023391a61d1

SHA256
c6456e009f077b2e65b4f09f4d051719735d8e00fde09db35541a80fcefd14fc

SHA512
ae1e565ef568af6a5829fdd1a81d6e52d645a8cf3ad4f1f3a9e9cbfdffdc3eb62167d5b4a2445283c62a8720234eae39c60c3ec71768c48cc5969466626b241f

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
99KB

MD5
f13366c7f2669ff4e8c77bcd807938ff

SHA1
08b833b866f08c4fd855fd3fe62ccc4bd5199579

SHA256
e06ea4ed87af076a52c6cb839f80fbd01f68ba9c34dfe433bd6f88bf9d786c20

SHA512
3b8074e4e3fb46e5b3c2b691480dc8cb42e90bb9a4d02b56cc6db10d0d2d6fd3539dce5cd08db1a3b1c6098356e1226657dd1e4b09ca7818ce6cb5cd07b0212c

Download Submit
memory/1972-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1972-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download