21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 04:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
Size

67KB
MD5

c8995a93b9a9a68d0abac378a3e09650
SHA1

a417a5dc5fcbab0e371fd87d0f3de5b01e61ad5d
SHA256

21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527
SHA512

0364d794c61dc280ebdb15d73a9b9bcf782aeff9d47535a4a50d2ef09d1ce44bedae4935975eee83ed7fb3536bbfa78797d02ef9cb2e9c024e8036da7ac69ed9
SSDEEP

1536:W7ZppApBULcfpHLcfpX2/Nw/NwmxLTopK:6pWpBwchcV2WxLTl

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3135) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\bckgzm.exe.mui.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IO.Log.dll.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Denver.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.css_1.7.0.v201011041433.jar.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.event_1.3.100.v20140115-1647.jar.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.clusters.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\vlc.mo.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\da.pak.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Tucuman.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\de-DE\Solitaire.exe.mui.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\twitch.luac.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\liblive555_plugin.dll.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\bandwidth.png.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\ShvlRes.dll.mui.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.ssl_1.1.0.v20140827-1444.jar.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup-impl.jar.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\DVD Maker\de-DE\OmdProject.dll.mui.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\La_Paz.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state_1.0.1.v20140709-1414.jar.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.properties.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-options.xml.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-US.pak.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IO.Log.Resources.dll.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsFormsIntegration.resources.dll.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Menominee.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Kiritimati.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Madrid.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_ja_4.4.0.v20140623020002.jar.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_zh_CN.jar.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Santiago.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Speech.resources.dll.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\AST4.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Speech.resources.dll.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\jhall-2.0_05.jar.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\RELEASE-NOTES.html.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\Mahjong.dll.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\ShapeCollector.exe.mui.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Internet Explorer\F12Resources.dll.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.VisualC.STLCLR.dll.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_ja.jar.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_ButtonGraphic.png.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\ffjcext.zip.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Irkutsk.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Baghdad.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_ja_4.4.0.v20140623020002.jar.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\.lastModified.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jre7\lib\security\cacerts.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansRegular.ttf.tmp	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe

C:\Users\Admin\AppData\Local\Temp\21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe
"C:\Users\Admin\AppData\Local\Temp\21e05ec1d25fbd8a6a56d330b557d479f1bad01b3a36b65d032cc56826b0c527N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
67KB

MD5
e3f6eb9c9b68ece07291247a3cbb8eda

SHA1
b49376457c50cf0cca2615b7aa51ab321bebb5b4

SHA256
710744df064931b23ee37098d7c579db007a3ef1e3bdc9fe2f6060066e344377

SHA512
a8d621af9d1c1c762dafdf71f09fc61c321ba58a0d271ebbbdf443303af93f4266c624a23dfeea06041a3b7ab0fbdb1513aa59bb504b3be7cbc0a5d064f27733

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
76KB

MD5
4194f0dfbc725f94e94b83603965520e

SHA1
f917bcc95b6a825fa4e7f5bc1cfaeecd92de36ce

SHA256
d309179a531c55f8a48ade697033211f5ed943d006379d611b1480b2e605de30

SHA512
f57b5262a6c82ad480b084db2d8ea5208dbb8bd025f89481e41daab11b606e722a0610164c5154b5943828d830d9144b101b7e891894a52a87fa538b8a9ae931

Download Submit