6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa

General

Target

6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
Size

85KB
MD5

3c9868d648a2a6eba861504d8f663d00
SHA1

210978a82897863fb3ea4c9ef1e6f126fc6924cb
SHA256

6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa
SHA512

e5376a740449677dfdd11eef3b13b0b9ce60bb94978c085f980ded145d9991805c496835bb9152e0a1fd7a2c763af21608a72e9192e8bf4ff99f3b1b388af2d2
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/Wys:6e7WpMaxeb0CYJ97lEYNR73e+eKZy

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3721) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe

description	ioc	process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Oral.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Santiago.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libmft_plugin.dll.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-windows.jar.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\bckgRes.dll.mui.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Design.Resources.dll.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Windows Mail\ja-JP\WinMail.exe.mui.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-core-kit.xml.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_ja.jar.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IpsMigrationPlugin.dll.mui.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Indianapolis.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vevay.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert_5.5.0.165303.jar.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.services_1.2.1.v20140808-1251.jar.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-modules-appui.jar.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libaudio_format_plugin.dll.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\clock.html.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\currency.css.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\22.png.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-crescent_partly-cloudy.png.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Common Files\System\msadc\msadcs.dll.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CST6CDT.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\leftnav.gif.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Java\jre7\lib\zi\CET.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java_crw_demo.dll.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_ja_4.4.0.v20140623020002.jar.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_zh_CN.jar.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\javafx-mx.jar.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Galapagos.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\drag.png.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jsse.jar.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\asl-v20.txt.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kamchatka.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Mozilla Firefox\application.ini.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\PopUndo.wav.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\SY______.PFB.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\de.pak.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\config.ini.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Vienna.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\MST7MDT.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Windows Journal\ja-JP\JNTFiltr.dll.mui.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\cpu.css.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Windows Media Player\it-IT\WMPDMCCore.dll.mui.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_partly-cloudy.png.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs_5.5.0.165303.jar.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_zh_4.4.0.v20140623020002.jar.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Noumea.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Mozilla Firefox\xul.dll.sig.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Client.resources.dll.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libvdr_plugin.dll.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\default_thumb.jpg.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\javafx.properties.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Resources.dll.tmp	6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe

C:\Users\Admin\AppData\Local\Temp\6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe
"C:\Users\Admin\AppData\Local\Temp\6b8eb957742c0f51fe0c9081d5ae6785f6afc9c81ccc28b045b8b8b6a03326fa.exe"
1⤵
- Drops file in Program Files directory
PID:2116

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini.tmp
Filesize
85KB

MD5
62e11ffe60f94e7fc0e2ebca9d6fc217

SHA1
e859126673f83e85ddef88c3b530f51875efcff5

SHA256
e4e0d84a03bcd395bc03b8ff93609dee32deae9ac516d61a71ea6e4d4556f57c

SHA512
abedf55cf3fc310cb95d2dc64555dd2a5680ec238a267e1883427635a25e9f9f096361d89d327ecf62f8b92a0f159272b3ee211903e996ba451079381e4295a3

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
94KB

MD5
065004858c4a22f2e657d8f5da2ecbcd

SHA1
be596dba1551005b0adfe0066f563ba65b7399ef

SHA256
e0aac50ab2b06b409a8c17c1a06726d6f4439943809876091f2a5b1c22297d9f

SHA512
f1bdcb1d6f0a57e2ddacf84c421128ccc50b7c416db90dada15ecd40f00ed6d125d561a6e671315bae81ae518c0e259e25936cfc1fd7bc27b8471f6e2d32fba9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads