Malware Analysis Report

2024-10-24 18:20

Sample ID 241018-czra7svckj
Target 39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N
SHA256 39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6

Threat Level: Likely malicious

The file 39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (4505) files with added filename extension

Renames multiple (2935) files with added filename extension

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-18 02:31

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-18 02:31

Reported

2024-10-18 02:33

Platform

win7-20240708-en

Max time kernel

120s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe"

Signatures

Renames multiple (2935) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Games\Chess\ja-JP\Chess.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Internet Explorer\en-US\eula.rtf.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\3RDPARTY.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_win7.css.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\DVD Maker\ja-JP\WMM2CLIP.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Montreal.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\shvlzm.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dushanbe.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpcore_4.2.5.v201311072007.jar.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Kiritimati.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\MANIFEST.MF.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-ui.jar.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+2.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\7-Zip\Lang\uz.txt.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\CircleSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guayaquil.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+6.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\license.html.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.preferences_3.5.200.v20140224-1527.jar.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\DVD Maker\Shared\Filters.xml.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\el.pak.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Antigua.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.properties.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Bahia.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Australia\Lord_Howe.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jre7\bin\servertool.exe.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Atlantic\Bermuda.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Games\Purble Place\desktop.ini.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jre7\bin\plugin2\msvcr100.dll.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_de.properties.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper.registry_1.0.300.v20130327-1442.jar.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-explorer.xml.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.dll.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.lnk.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mauritius.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.SF.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\LINEAR_RGB.pf.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-14.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterBold.ttf.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Africa\Khartoum.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Yakutsk.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\layers.png.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Internet Explorer\JSProfilerCore.dll.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\include\jawt.h.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\org.eclipse.rcp_root_4.4.0.v20141007-2301.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_basestyle.css.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe

"C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe"

Network

N/A

Files

memory/1864-0-0x0000000000400000-0x0000000000408000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

MD5 1882d9832432c819b1da4a4809b28c08
SHA1 4210ef68c6b220b8a5966ca274a43d77dd686c92
SHA256 d1742d767f72cab3532c79ce044c93921d93eeef4c632b996f0cf97630a0da57
SHA512 8487b74268c9e186a9738a9c2df32d688758b7862893b4b451bdeae2ecb6982041f87076d314b462a4a70a8cbee755f3198305c81199c1cfd3b899122174dd7e

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 d2f22b0b32f9834ff57f205a549107e5
SHA1 7e6bf800611d68d015db129cdc93637a2e5938bc
SHA256 c0bd35527bab196a2c9acc99f6910ce0aa4422b2d517b1bfcd87ee096abd3f69
SHA512 f2008c7d6f3ba2d0791e65ada0fa6b04ec2112083e5bae28c629a53e5adf9fb73d01391e60c1faebe4355ed91d74578e1c5e635ffef746b28d683981adfb6f9c

memory/1864-68-0x0000000000400000-0x0000000000408000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-18 02:31

Reported

2024-10-18 02:33

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

107s

Command Line

"C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe"

Signatures

Renames multiple (4505) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.wordmui.msi.16.en-us.xml.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationUI.dll.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Configuration.ConfigurationManager.dll.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk-1.8\lib\orb.idl.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\7-Zip\Lang\gl.txt.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationProvider.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Csp.dll.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-100.png.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-100.png.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Input.Manipulations.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\123.0.6312.122.manifest.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Common Files\System\ado\msador15.dll.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\xmlresolver.md.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTOCOLHANDLERINTL.DLL.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Web.Mvc.dll.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHLTS.DLL.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-100.png.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-process-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngdatatype.md.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.XML.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\WindowsBase.dll.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\concrt140.dll.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\javafx\libxslt.md.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\management.dll.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe

"C:\Users\Admin\AppData\Local\Temp\39ee578f0d2e4e8541470652fbdb50287f5f0d3e501fe1bce9fda83b6cf31aa6N.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

memory/3900-0-0x0000000000400000-0x0000000000408000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3227495264-2217614367-4027411560-1000\desktop.ini.tmp

MD5 6bf43e953f887ab6be6dc08d136ed947
SHA1 a32cb11cc9505776b75bf79addafdef7f4c6fc62
SHA256 b35af9de0cceb020539f46bfe5cba7dc8353131494f821f0536b791f4cce06f8
SHA512 bacd19b7e55c11b1579e5190a063aa660f3fe449bab7b476b93025a43917646438044b33dc3a49be3b6bf0529971a83f0924a4f1a82831557b261b4345ffb8b4

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 9263b6cc2d035283da0afb6ebbc58742
SHA1 98f06bcd0f91b7f372cadf21c95e9cff5de93883
SHA256 5126609de35bb960b8e23b9edd90eedfeb5d385a8c185efd128ccad3a442e0a0
SHA512 8aabf1b9a743ab808aa89ee0fd8402aa019523b27cfa859e4ce4c7d806d5577be6080f95e5da14c6354d01021f945d2b3f212c7792c23acb30875b81f0ac580e

memory/3900-658-0x0000000000400000-0x0000000000408000-memory.dmp