8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
15/10/2024, 02:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
Size

47KB
MD5

5c19f79a3b5f9625325a1b8e135569d0
SHA1

908425129a2b85d03b858af86264bce93bc58111
SHA256

8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978
SHA512

1074d4a51e4bc3953779545aafbbea25a3be4a27f175533ba82fd0e084bf5696458f655accc141407581ba4cb46ce2ef19ebf86ccc376f8347b8b92e73826348
SSDEEP

384:GBt7Br5xjLfAgA71FbhvtPcNOF8F0qOF8F0PDXxhDXxW0C2CSJHrJHi:W7BlpDpARFbhmauaLXxpXxW0C2CSJLJC

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (332) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\vi.pak.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipBand.dll.mui.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcfr.dll.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fr.pak.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fil.pak.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\System\msadc\handsafe.reg.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\highlight.png.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_SelectionSubpicture.png.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mip.exe.mui.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-PT.pak.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mip.exe.mui.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\DVD Maker\ja-JP\OmdProject.dll.mui.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\7-Zip\7z.sfx.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground.wmv.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\it.pak.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe

C:\Users\Admin\AppData\Local\Temp\8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe
"C:\Users\Admin\AppData\Local\Temp\8f3620cf4995d152abdca1123df9c54094374bb218e07e8dbe3e37bac914e978N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3692679935-4019334568-335155002-1000\desktop.ini.tmp

Filesize
47KB

MD5
c7569bb88837762696812a7732b00596

SHA1
83766e603547672f30bcb35af5df94be566ac25a

SHA256
f1155e438870e5d626811a429211bb129d80accb165d285b71839d7bd385f5fa

SHA512
b35ba02b130ba9d80d3ce06e6055be2a60cecdf24c5358923df8de66b96a21a0157aaf6897a9aee61ee76c5fedaa9da6f29653ea5f380ffffcb39e76a5932668

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
56KB

MD5
a51845791c6d6a969998377fa76418c5

SHA1
d6f89d7406d4a4e9bae38dade6372e5ea2f5eab4

SHA256
7a3779894f1cf611f348155b46e4e847cc60ed9e815e938efe513740a12ba32d

SHA512
0cafbee39f2726c4347f95ab434cada9d21fcd17942180167b02144e2394665e7721d473e7d46db4057b203231db7e760cf6b5136d193d49e88b9a58f9084883

Download Submit