bff891d0978bca0f710a6e023915ce8361580c33ec938e4220242714049b9c4a

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 06:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21b19b8a9730a6fd73a16a1a92088b30N.exe
Size

50KB
MD5

21b19b8a9730a6fd73a16a1a92088b30
SHA1

172049b23919d20cbb6c74c5e93c4b2529a2db8e
SHA256

bff891d0978bca0f710a6e023915ce8361580c33ec938e4220242714049b9c4a
SHA512

480959cfac5978fbddd2d1678b8d2640b74014b8f5696842638d95143c92ac47f1c96e181baa3505cc5a6b1e058b44f0697a60a62e6e5e3e17d64ec4cd640832
SSDEEP

768:W7BlpppARFbhHFoqAJwBqAJw1VyjVyfxAkJhxAkJRQmJKbQmJKo:W7ZppApyVyjVyTQmJ0QmJ7

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3232) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\vlc.mo.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\classfile_constants.h.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application-views.xml.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jre7\bin\gstreamer-lite.dll.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Adelaide.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Pangnirtung.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\MANIFEST.MF.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Athens.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Lisbon.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libtextst_plugin.dll.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javafx.policy.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\DVD Maker\it-IT\DVDMaker.exe.mui.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcfr.dll.mui.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_it.jar.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bishkek.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Mozilla Firefox\notificationserver.dll.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.properties.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh001.htm.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\orb.idl.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jre7\lib\management\jmxremote.password.template.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsoundds.dll.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\New_York.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\DVD Maker\ja-JP\OmdProject.dll.mui.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Andorra.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Apia.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-environment-l1-1-0.dll.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Internet Explorer\en-US\eula.rtf.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+2.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jre7\bin\jli.dll.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Belgrade.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jaas_nt.dll.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belize.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-tabcontrol.xml.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Midway.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.c.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_ja_4.4.0.v20140623020002.jar.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\fr-FR\Mahjong.exe.mui.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\am.pak.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-12.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ulaanbaatar.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_zh_CN.jar.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-uisupport.jar.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_ja.jar.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_zh_CN.jar.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jre7\bin\server\jvm.dll.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Simferopol.tmp	21b19b8a9730a6fd73a16a1a92088b30N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	21b19b8a9730a6fd73a16a1a92088b30N.exe

C:\Users\Admin\AppData\Local\Temp\21b19b8a9730a6fd73a16a1a92088b30N.exe
"C:\Users\Admin\AppData\Local\Temp\21b19b8a9730a6fd73a16a1a92088b30N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
50KB

MD5
976196eec8915637da70fae1f52d66ee

SHA1
7f14b4235d0c1af35e0c4bd49193e047dd7b4e45

SHA256
fd7579983de5255bbd26098c4c896874b43914d8335d5956273c83875de1bfc3

SHA512
88ececc9ee073011dddbb04d9eec8a39bf440ea25413970b472cdd70c681b3f641a03f14ac4a4b280467f14c718ac68687ae81fc3fcf7901016a9032458904a0

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
59KB

MD5
9e6fe4cb9bc706b93eefb3a1d8184c67

SHA1
87c437ecde241eb70e2bb4e581b5c58fe037f820

SHA256
490d0c779578505bc1910e9a35a6f3911666b155e152b702646ca2d6e52805ec

SHA512
ed964216a12620cef1e781851e1e17351d17f76dd0cbcf64aac53443e2ed450999d3fea468ea097977dba0bae1e83906e093a8682ca4eceb559bea71c658da93

Download Submit