21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71a

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30-09-2024 02:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
Size

54KB
MD5

a307d72e6af2d9db4e8499577ace4420
SHA1

98b17d567b02b95e53a5f997d2a7860ccb0f1146
SHA256

21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71a
SHA512

1d162d567fe02154fe7da14aef974090ab689de2209edc6c71bd91e6f326cee31fd8622dedf9fc75cbfe682bf9c74e74d1ff55e8386c62f25e79b943964eb3ae
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfpW/fSwN1J3DCl4N1J3DClEutB:W7ZppApBULcfpHLcfpAS5tB

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4518) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\am.pak.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\default.jfc.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-pl.xrm-ms.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.resources.dll.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Franklin Gothic.xml.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationCore.resources.dll.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Internet Explorer\de-DE\ieinstal.exe.mui.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.NonGeneric.dll.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationFramework.resources.dll.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ppd.xrm-ms.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-pl.xrm-ms.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.EventBasedAsync.dll.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Primitives.dll.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Graph.exe.manifest.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\desktop.ini.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\VVIEWRES.DLL.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-phn.xrm-ms.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClient.resources.dll.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationFramework.resources.dll.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Java\jre-1.8\bin\t2k.dll.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-1000-0000000FF1CE.xml.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-100.png.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\DisableWait.dwg.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140_1.dll.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ppd.xrm-ms.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClient.resources.dll.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ppd.xrm-ms.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.dll.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.resources.dll.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\LICENSE.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office-client15.xrm-ms.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.X509Certificates.dll.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationTypes.resources.dll.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql90.xsl.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ul-oob.xrm-ms.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CERTINTL.DLL.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.Vectors.dll.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-util-l1-1-0.dll.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ppd.xrm-ms.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-math-l1-1-0.dll.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ul-oob.xrm-ms.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.Interop.Excel.dll.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Java\jre-1.8\LICENSE.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART7.BDR.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.dll.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.dll.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NameResolution.dll.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.dll.tmp	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe

C:\Users\Admin\AppData\Local\Temp\21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe
"C:\Users\Admin\AppData\Local\Temp\21bc6223990fd4de22b51680eb6ee8498d4565be47cf13f7d8c697743a94b71aN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
54KB

MD5
d197ac28641e73dc72d69ebd04eb75fd

SHA1
6616a393e86c160395b4a113ff4d0adc0d6e6607

SHA256
81b5651445e22093caddf66b113b4a10b235a7bd0c1be2e44a9f9d54b770f4b8

SHA512
5887fc2d0ff36f21ed11159972772b146e275d1283655469277bc7a6eec92c218e34d8a8effde0451af9362d6047754a79cc599999f0ac5f7308720af9fdeeb4

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
153KB

MD5
e59dc2f1bf48a94719cdbbb013306382

SHA1
0a78137585814f726a4b91940c1c269d3f08277d

SHA256
819414494b25ee358681542ee2b3dc058b6bd4af0be074c8ac732f8e8b78252c

SHA512
4872171e7003ec897a84210d54d148a5ad380139e201038ebc03ac30d909a52c924ac77e1b3ad2b735eccd2a11ce1c891862bcdeb3ef852c7254db37546341a3

Download Submit