dafba00033eaa93371b992a40d992ee2b732b86f8a76a16f06b7fa0d149fb9ef

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
Size

68KB
MD5

10b0e6c0dbf1cc72c4f9abece2e2f650
SHA1

0cdc3c4923ac1c26f06e8d9f629a568886d240a4
SHA256

dafba00033eaa93371b992a40d992ee2b732b86f8a76a16f06b7fa0d149fb9ef
SHA512

df9b87b4227169eb566a8397565dfa1aaacd129053dd44afe75849d3ddc4180266cf1c53f2710d17928fa30f9a8fe7efbb2b353eecbee338dc05c88c7552fd58
SSDEEP

768:W7BlpDpARFbhYQkQzaxkd+axkdo176/hvYaJaMGw4PCs2B24PCs2BHE4JAIAepEK:W7ZDpApYbVK4vx4PN54PN4OHepOHeZSi

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3156) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql_2.0.100.v20131211-1531.jar.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.ServiceModel.Resources.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_ja.jar.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.resources.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.DataSetExtensions.Resources.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_highlights_Thumbnail.bmp.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Magadan.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_zh_4.4.0.v20140623020002.jar.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-spi-actions.xml_hidden.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Nicosia.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClient.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.registry_3.5.400.v20140428-1507.jar.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\UnblockRestore.eprtx.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libshm_plugin.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jre7\bin\nio.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Monaco.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-oql.xml.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-threaddump.xml.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jre7\lib\resources.jar.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\ja-JP\PurblePlace.exe.mui.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-environment-l1-1-0.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4_1.0.800.v20140827-1444.jar.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-nodes.xml.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Resources.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-services.xml.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Canary.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ur.pak.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh88.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_ja.jar.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.xml.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Christmas.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.nl_ja_4.4.0.v20140623020002.jar.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans_1.2.200.v20140214-0004.jar.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvm.jar.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Moscow.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Mozilla Firefox\osclientcerts.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\whitemenu.png.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guadalcanal.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libmmdevice_plugin.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipRes.dll.mui.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\DisableComplete.xltx.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.ja_5.5.0.165303.jar.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt_0.12.100.v20140530-1436.jar.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_zh_CN.jar.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-plaf.jar.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.WorkflowServices.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_ja.jar.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\ChkrRes.dll.mui.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Menominee.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe

C:\Users\Admin\AppData\Local\Temp\10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
"C:\Users\Admin\AppData\Local\Temp\10b0e6c0dbf1cc72c4f9abece2e2f650N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

Filesize
69KB

MD5
b1be7e2837f2311f33c9ce53df7aaacc

SHA1
60aee670f447f714ca2968ad0809e0770c2264a4

SHA256
f68554acf577343fba97368c0de3929c303266a5fd6764685ce1d52b0be0f01e

SHA512
19ea763f06c63a89541faa930c32bf27b04dee75ce00607ff36a37f64146e869d2bf8072e7ca22097a69227e36a5b5b7881528f3873194dbd86f99c5af6a42bb

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
77KB

MD5
d3eb07b536a6541ccefcb0076271ecf7

SHA1
14ea432fb461a16a3708c8809b71818bf96ee5b6

SHA256
4d10b4a204b15ee8517d63bf42c691e07b6534e47761467080651ae81d9e8db5

SHA512
31b3902069ae4011e9b4d0afb5deb850588932f6c2a941677c989336a8f1511fe311337868bd6fd7bd8e719e30bf8549cc3ebeebd9ce96413d70e680d3af3bfb

Download Submit