Malware Analysis Report

2025-03-15 08:18

Sample ID 241016-fl5hfsxgqr
Target 1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN
SHA256 1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7a
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7a

Threat Level: Likely malicious

The file 1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (4639) files with added filename extension

Renames multiple (3212) files with added filename extension

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-16 04:58

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-16 04:58

Reported

2024-10-16 05:00

Platform

win7-20240708-en

Max time kernel

120s

Max time network

16s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe"

Signatures

Renames multiple (3212) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Easter.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\203x8subpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-favorites.xml.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\SystemV\MST7MDT.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access\libbluray-awt-j2se-1.3.2.jar.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-uihandler.xml.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\UninstallLimit.mpeg.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\vlm.html.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.xml.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader_icd.json.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxwebkit.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.security.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Srednekolymsk.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Darwin.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwritash.dat.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\tools.jar.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmad_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rio_Branco.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+8.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Davis.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+10.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-search.xml.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Australia\Currie.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Chihuahua.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\liblibmpeg2_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Samarkand.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\7-Zip\7-zip.chm.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tehran.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libaes3_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sig.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kosrae.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-options-keymap.xml_hidden.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh89.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunmscapi.jar.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.xml.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiItalic.ttf.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sl.pak.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Sakhalin.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Net.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libscte27_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe

"C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe"

Network

N/A

Files

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

MD5 fd8b6177a670ca520538f1792c75abcf
SHA1 10213b3473054e40b8d8a32547ae82067a21244e
SHA256 f27503fdfa442953ad5ed1ac5d17be2718ad2974c7b7e105ea06120ca33f6527
SHA512 a5bc0f9e2685f906d1f74f0da096d489443b3cea0cec914b37f32cf4ef1bed354c4f8dff423266c69b58a0dd54a5125c64d2f30599e52a59570ed43c4b55d6ab

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 9c78f60d6d17899f377c3ecced7a548a
SHA1 74afa2b79772d0e532470fff278b31f93ae6bd03
SHA256 70670766bfc8cc4916bc6ad466c872a4f4df353b4ddc9a4e537ead033de9b682
SHA512 686f0af02b711baa08b9b450305b5ec607004b4426202d1878b64147de2771bfb8e4130c94b85f2f8dd9781883e71d2c1e9b0b8e8f9272fc60a4ae28d402080a

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-16 04:58

Reported

2024-10-16 05:00

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

105s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe"

Signatures

Renames multiple (4639) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-80.png.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\7-Zip\Lang\an.txt.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.RegularExpressions.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\mscss7es.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.HttpListener.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\excel-udf-host.win32.bundle.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\7-Zip\Lang\bg.txt.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Common Files\System\msadc\msadce.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\java_crw_demo.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\mscss7cm_fr.dub.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\7-Zip\7z.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrfralm.dat.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.VisualC.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\7-Zip\Lang\vi.txt.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\msvcp120.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Primitives.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Linq.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Primitives.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLEX.DAT.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.X509Certificates.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\security\javaws.policy.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrgc.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\lt.pak.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Localytics.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\DirectWriteForwarder.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sv.pak.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\j2gss.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\verify.dll.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoCanary.png.tmp C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe

"C:\Users\Admin\AppData\Local\Temp\1f8d8fbee26db80eeff916597182aeb8e6b04f46b021632e7e323b39b8000e7aN.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 73.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

C:\$Recycle.Bin\S-1-5-21-493223053-2004649691-1575712786-1000\desktop.ini.tmp

MD5 5bd16b871e4229cc5242ca6caa3d8b5d
SHA1 4973cef09d011d58e3702faf794b6aa4174a5c3e
SHA256 581d39a8f872ce65933693e52ff0bc03192fcc24849fdf168f3e9714ce378974
SHA512 872b3852cb97f1f29e5b83de12ef0c83df06bf190269a12fc2009282eb3349f7ef3489f5a3a8c57d7aadf8244a5352be5bf2562f263f78a077a4a38fc9baf5d7

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 29bab82ebe581c1dd057a02a13817f3f
SHA1 5244f855f23196699cca07b85f787c98fabc7c94
SHA256 338822a8f790eb57b1c7f4b4c4072abd1b420e5441c63b6c239b1107e8abfaf1
SHA512 262852af270111e3b1037ecc27ea71bf650fc1778fb031322662c95cc50180472d8c7e861dbc0d51018e7249cb0e2d4baaa90aac21032fc1843f7cb21ff15504