adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 15:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
Size

53KB
MD5

8bc1bd82bb6c6abf19571f47a88d4d30
SHA1

0c4011c0deeaaddab7319e7d9b352b9bcff7c582
SHA256

adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70
SHA512

60a9dbc62b8618f07d1f3358d9e1b6ff3931b8a66ad2ab16960b01a061a81b79137b8f2ea409769dcf2f9b146fe9153c01ac5666035d359d2ac2e18d714232a7
SSDEEP

384:GBt7Br5xjL9AgA71FbhvuNBNKVkVYlIAItCCIntkntV/uJ:W7BlpppARFbhFAxC7ntkntV/uJ

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3307) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Berlin.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libtaglib_plugin.dll.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Java\jre7\lib\security\javaws.policy.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationProvider.resources.dll.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\vlc.mo.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_highlights_Thumbnail.bmp.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Fiji.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861258748.profile.gz.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Java\jre7\bin\rmid.exe.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Midway.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sig.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libopus_plugin.dll.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground_PAL.wmv.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_plugin.dll.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.bfc.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dubai.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Krasnoyarsk.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tabskb.dll.mui.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Prague.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rightnav.gif.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Athens.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClientsideProviders.resources.dll.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libnsc_plugin.dll.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-locale-l1-1-0.dll.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\DVD Maker\it-IT\OmdProject.dll.mui.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_ja.jar.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Algiers.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_ja_4.4.0.v20140623020002.jar.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\high-contrast.css.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Simferopol.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libxa_plugin.dll.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\access-bridge-64.jar.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Karachi.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench_3.106.1.v20140827-1737.jar.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-over-select.png.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunjce_provider.jar.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-lookup.xml.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util.xml.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Monterrey.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\vlc.mo.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsubstx3g_plugin.dll.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.xml.tmp	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe

C:\Users\Admin\AppData\Local\Temp\adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe
"C:\Users\Admin\AppData\Local\Temp\adbda7c081b4b6d13a63021fe4f864d5b0bbcb6430636f9c223b677edbf6ec70N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp

Filesize
53KB

MD5
48ce7e41929afc55222465e51177bd5b

SHA1
ac103acf24c1d02af112423055b88fa58ea7dfe9

SHA256
b2612aef1a7b2c39725f37ffe388eb3401544ff245a7c5e215b02facffdbf581

SHA512
40b21a5b80d7fe62a4c5957f88d02bb7c48b70108390a723e35e238591c3afe53330f04d45d19ee635dd5a4746e96d3d6751c2bac4db980673849507da7c21e7

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
62KB

MD5
b663e1eb8f733a2f6a95423591e1f04e

SHA1
dc917256b6b767904386f325d12a4790c586ae8e

SHA256
2fede3e2304313bbe7053d19e59d4dceff867a6a317955350c0b7676e2fd9315

SHA512
965e510693f775b9a2f88b968520a5abca1b66435a52e9dbbfe4886068d432a5a3563e8fe93db76369624d553e1cce3fc79accfd402c6ad7bde14c70e6f8d3c9

Download Submit