0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc

Analysis

max time kernel
150s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 18:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
Size

65KB
MD5

c44bac0332616c4f6e52f9f1648f3acb
SHA1

8d1d36a584514ea0c1b8dc8ed4dda16f2f807339
SHA256

0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc
SHA512

7b10c2978272a15cb2ae80f76e6f0e2d333923764cdbe942178a401632ffa070ea7c2f8d43c1a82a00251abf7e2ece5ba2156448dac4d460cfc5e3bb7b329a66
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfpVF/MF/3Nw/Nwk0cEMdV8IEMdV85/8O0Oxe3:W7ZppApBULcfpHLcfpX2/Nw/NwmxN

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (520) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\nio.dll.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\npjp2.dll.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tabskb.dll.mui.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-highlight.png.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\fxplugins.dll.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\micaut.dll.mui.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\travel.png.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Internet Explorer\MemoryAnalyzer.dll.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\7-Zip\Lang\he.txt.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\te.pak.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\colorcycle.png.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.c.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\LICENSE.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Internet Explorer\jsprofilerui.dll.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpn.dll.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java_crw_demo.dll.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_SelectionSubpicture.png.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\deploy.dll.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\DVD Maker\SecretST.TTF.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\chapters-static.png.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Internet Explorer\sqmapi.dll.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\attach.dll.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrespsh.dat.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tipresx.dll.mui.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv.tmp	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe

C:\Users\Admin\AppData\Local\Temp\0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe
"C:\Users\Admin\AppData\Local\Temp\0ba75c5084215dff4a9310ed834549e3dc295aa357df726f7c7f4fd5920a90fc.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
65KB

MD5
0197a1a2c45e71d4b208886cfa5497da

SHA1
ee01b5688146978e815c33e1adfbe657533ef6e9

SHA256
86a769ad6c0b86caa5e22fdd6625375c946a09d188a84c28c4d7ac785d2eeef7

SHA512
7c19a17551947cfa3abd061a0406061aa103f4161c8811be3adca10c5f95ab1c4d8526e0131573258b5529d42548461cd56e877d8c633f650fec1f6611c75931

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
74KB

MD5
5ebd59d32682d8d1cf1ebceb3103c45d

SHA1
0934f058b14edfed671768503ee2a6d3c70d599c

SHA256
1fd2198f17cd1bf811070e86b0a67c3bc81f12777febd07aa7231c12aa1e9e03

SHA512
d18554bf92554f3cbf721d10c5c8f779f1a968a440f8b9fb26d6aabe55ce739aa68fc1713d29f4a9e9887bf63a620fa7b190b71478ddcab794d618645bd7f3ac

Download Submit