6deee864933a513c4674808b362cf98edc160b5b61d848f67146617094a7673e

Analysis

max time kernel
120s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 13:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

21c5f7365dcbf55125d90d749a07e0e0N.exe
Size

44KB
MD5

21c5f7365dcbf55125d90d749a07e0e0
SHA1

7e2abd9488bc2b79f58df91a3b0453460c7126f0
SHA256

6deee864933a513c4674808b362cf98edc160b5b61d848f67146617094a7673e
SHA512

f6fbed3973ab9ff688bbe88a7ecf407811edf3764de9489da5fac4601c4c1624a3c5eacf9a24346ea2c7e09b01c3ebea22787ad779e474dc6efc9ce53af33890
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LORWAnWAkpUE5c5YbfCDTbfCDMj:W7ZhA7pApM21LOA1LOrtkpt6WbfGTbfT

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4663) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Core.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClient.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ant-javafx.jar.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\hostpolicy.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\wpfgfx_cor3.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Input.Manipulations.resources.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\content-types.properties.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr\default.jfc.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\README.txt.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-phn.xrm-ms.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\wpfgfx_cor3.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-xstate-l2-1-0.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Luna.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\java.policy.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ppd.xrm-ms.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymxl.ttf.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.AppContext.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Extensions.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.RegularExpressions.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClient.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ul-oob.xrm-ms.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationTypes.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_TW.properties.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javafx_iio.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.SecureString.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Primitives.resources.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\msvcp140.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ul-oob.xrm-ms.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIANEXT.DLL.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.ThreadPool.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\WindowsAccessBridge-64.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsFormsIntegration.resources.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\ReachFramework.resources.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\zh-TW.pak.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ul-oob.xrm-ms.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostTitle.XSL.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Primitives.resources.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLTS.DAT.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\PRIVATE_ODBC32.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsBase.resources.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Registry.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ChakraCore.Debugger.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\MSIPCEvents.man.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_sw.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Queryable.dll.tmp	21c5f7365dcbf55125d90d749a07e0e0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	21c5f7365dcbf55125d90d749a07e0e0N.exe

C:\Users\Admin\AppData\Local\Temp\21c5f7365dcbf55125d90d749a07e0e0N.exe
"C:\Users\Admin\AppData\Local\Temp\21c5f7365dcbf55125d90d749a07e0e0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
44KB

MD5
c7f51f80f0eefab85e2dc43c8f587c75

SHA1
14ac119e68e9a26b2e7728aa41df757af7a7d455

SHA256
6ef84fa9a7b8b1817569916d6c6aa3aafc38523e13e2ff378f8c4d25a93c1787

SHA512
8082831c57752648ba42adb96d099a12bb21c9196d5d383c228461fd3e71fe89d876454518329ad537e01c2df2d51bcea82ae8e842884918de30c086bbcaa1fd

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
143KB

MD5
e4d8af8ae4846a8d885790f96444412e

SHA1
6474037b481805191df327313a6de1e453a2cf46

SHA256
f77d85b9d64170e5a99f9f450d5edb01a666bf449583dee095c9bfbf2f154589

SHA512
e19e1ff1ca39e97c7c785bc85efee82025f217cfba7c36ed95f2e92c0f39bbf5d46cba10240554543602ec5da8776a8e05114afe20c7482fb294c72eac640402

Download Submit