903a6255bbf62d4230d6b8867d13d27888401d6e7bd158700dfd2c1aa672fb2a

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/09/2024, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

21489e56accc2a4bd0f015066814f340N.exe
Size

88KB
MD5

21489e56accc2a4bd0f015066814f340
SHA1

d018ab4c44337587ddeabfbc715963b32ed12e79
SHA256

903a6255bbf62d4230d6b8867d13d27888401d6e7bd158700dfd2c1aa672fb2a
SHA512

3dcf2655fee019f36d7aee4ce215c158833eca9000ffb3042a2741c116f999fc9aafbe59be12071f9eee1291981e16b9e9a34af9163ca725f51451f17a02d6af
SSDEEP

768:W7BlphA7pARFbhXJOYLCqh86ICqh86++c+HmSwvcAivcA/:W7ZhA7pApXTdsdYSU1u1/

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3086) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.metadataprovider.exsd.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jre7\bin\jfr.dll.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Jujuy.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Copenhagen.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jre7\lib\javafx.properties.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multiview.xml.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Toronto.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+9.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dushanbe.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuching.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_ja_4.4.0.v20140623020002.jar.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_zh_CN.jar.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-api-visual.xml_hidden.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Fakaofo.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libftp_plugin.dll.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Yakutat.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Microsoft Games\Chess\es-ES\Chess.exe.mui.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Recife.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Juneau.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands_3.6.100.v20140528-1422.jar.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_ja.jar.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_zh_CN.jar.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Chatham.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Entity.Design.Resources.dll.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_SelectionSubpicture.png.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_zh_4.4.0.v20140623020002.jar.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyclient.jar.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer_3.2.200.v20140827-1444.jar.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_zh_4.4.0.v20140623020002.jar.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Glace_Bay.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Microsoft Games\Chess\desktop.ini.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\icudtl.dat.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.properties.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-compat.xml.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\RedoGrant.rmi.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.xml.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-modules.xml.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-javahelp.xml.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-utilities.jar.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\dailymotion.luac.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Faroe.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novosibirsk.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-charts.xml.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jre7\bin\java-rmi.exe.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Microsoft Games\Hearts\fr-FR\Hearts.exe.mui.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Management.Instrumentation.Resources.dll.tmp	21489e56accc2a4bd0f015066814f340N.exe
File created	C:\Program Files\Java\jre7\bin\jpeg.dll.tmp	21489e56accc2a4bd0f015066814f340N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	21489e56accc2a4bd0f015066814f340N.exe

C:\Users\Admin\AppData\Local\Temp\21489e56accc2a4bd0f015066814f340N.exe
"C:\Users\Admin\AppData\Local\Temp\21489e56accc2a4bd0f015066814f340N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini.tmp

Filesize
89KB

MD5
46ceabd1ce8db3cfa87b735bd1329fa6

SHA1
0871e5edf2ffecc017edfdb17d801882389773a5

SHA256
8db82e14a93b69086492b9d25bec0b7ce767aed4b5ec2030fc81f24193aca2cf

SHA512
59a6d241bec6d5521e6f7b14d0d2aded9bf9545f3644a4980a8bad761495d0ff178b0bab47171bc8ae288f2c6a647acf65aa594ac25c8731aba1605b08b7abae

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
98KB

MD5
636a48c3de8bc53cc8fabf25d32d034c

SHA1
8841d22de0f9d55ca8edaeac4f2b7fae3ec08d4d

SHA256
24900f23dcc7eac5abbf58877d12b424810882f03b3e48a294ccbf810a8f8a99

SHA512
d13753ecbdb75f400b3344e46bd6825ad204f5ac569b7af930c640dd336a6c63a138a02994b74ca79856d5232d81acc1281c99a982d89435ca78501ff55306a6

Download Submit