Malware Analysis Report

2024-12-07 10:16

Sample ID 241112-xjebxsyfmm
Target e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe
SHA256 e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082

Threat Level: Likely malicious

The file e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (4598) files with added filename extension

Renames multiple (2907) files with added filename extension

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-12 18:52

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-12 18:52

Reported

2024-11-12 18:54

Platform

win7-20241023-en

Max time kernel

120s

Max time network

16s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe"

Signatures

Renames multiple (2907) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UCT.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fiji.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Mozilla Firefox\minidump-analyzer.exe.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\7-Zip\Lang\ca.txt.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\1047x576black.png.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper.registry_1.0.300.v20130327-1442.jar.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-remote.jar.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jre7\lib\resources.jar.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Mozilla Firefox\browser\features\[email protected] C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader_icd.json.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\GRAY.pf.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vincennes.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Merida.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\DVD Maker\es-ES\DVDMaker.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh87.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Istanbul.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\masterix.gif.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\jhall-2.0_05.jar.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jre7\bin\jp2iexp.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Auckland.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.ServiceModel.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\include\jvmticmlr.h.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\tpcps.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.css_1.7.0.v201011041433.jar.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.xml.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler_1.2.0.v20140422-1847.jar.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Mozilla Firefox\nss3.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-output2.xml_hidden.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Engine.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.bat.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Maldives.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Caracas.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Moncton.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+11.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\whitemenu.png.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\ffjcext.zip.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\license.html.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-startup.xml.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core.xml.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+7.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe

"C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe"

Network

N/A

Files

C:\$Recycle.Bin\S-1-5-21-1163522206-1469769407-485553996-1000\desktop.ini.tmp

MD5 3ed3f203accd41170ae028d48d3d501c
SHA1 21872c4f16d2ad9d840564c99423140cca7ac68a
SHA256 97ffd6736ce8a2059932e628a274fbc20830a9a53af9259761c9326bd4a2c80e
SHA512 c5424739a3b9ff59da601f69704fa7ee9662479bc5de9c0723e923f22c375b7679d351692a24bec616951c1b3ce40c27936dd0c7b73b3c0c010db11b383d8f21

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 15cb56e1e7ad8c6af50b77679530e771
SHA1 8128ef3753c12b99dac1059c2f2a358af246eac6
SHA256 048a55c4e9ccabd564ed528fab71250c9819f380a8f86618674d2ce20047f90c
SHA512 f8021f52742e9d38882192c5df6f867b784fc21ef88cffed29e5f7c38a53f04d3c1a6a371eee09fa9c0eb5cb1ef0b7f37db2493d6471e1277ab14905afb844ac

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-12 18:52

Reported

2024-11-12 18:54

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

93s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe"

Signatures

Renames multiple (4598) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Claims.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\java.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cryptix.md.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\Logo.png.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.powerpointmui.msi.16.en-us.xml.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-80.png.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\Welcome.html.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Internet Explorer\ielowutil.exe.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\cmm\sRGB.pf.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\ReportingServicesNativeClient.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymsl.ttf.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\WORD_WHATSNEW.XML.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\client_eula.txt.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\mip_upe_sdk.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieXLEditTextModel.bin.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\7-Zip\Lang\id.txt.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\hostpolicy.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero2.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\7-Zip\Lang\co.txt.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\security\java.policy.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.dll.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxslt.md.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-100.png.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe

"C:\Users\Admin\AppData\Local\Temp\e9922d440a7a2c7f65fc333d418cad7fdbd81447c9f511c4bc127a1d6f2af082N.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 71.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp

Files

C:\$Recycle.Bin\S-1-5-21-940901362-3608833189-1915618603-1000\desktop.ini.tmp

MD5 4862484498febc11eb8984183c87dd23
SHA1 af9e7056454407cccdcab0d9e06508eb3d739202
SHA256 8effb22f1a450418dd89a53bb69bfa13d62144cc7674eded8b8aef398921abbf
SHA512 18f3f7da9a3572874d635fff35c8d2721e12c970e761962140fd5cc775ed1db6928a0e6c739d9582fa66a4d14c3837798b20c873861110d1185eb0a836daf845

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 f11ac456d9daff2472df6f943d640ce2
SHA1 85c74c053afcea543fcae18634ba4556c21df9d4
SHA256 fc2901b618b4fb82820b6d274a720c2808661922e0e0e9a3c2ce1605b6f436ab
SHA512 c792ad3b14f2f5f7ee08add2d95831c0311e8d3c4c8543f9dc760fd808e10fff8adfc963700090aa012a7d28a8e7b697661ff5e6c8f8fe5e908d750b5cba5335