Malware Analysis Report

2024-12-07 10:20

Sample ID 241113-a5y7wstgrm
Target 97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8
SHA256 97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8
Tags
discovery ransomware upx
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8

Threat Level: Likely malicious

The file 97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8 was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware upx

Renames multiple (5271) files with added filename extension

Renames multiple (3728) files with added filename extension

UPX packed file

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-13 00:48

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-13 00:48

Reported

2024-11-13 00:50

Platform

win7-20241023-en

Max time kernel

149s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe"

Signatures

Renames multiple (3728) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.xml.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\blafdoc.css.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Internet Explorer\F12Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Efate.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Windows Defender\MpAsDesc.dll.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-actions.xml.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_realrtsp_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\ffjcext.zip.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-1.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-remote.jar.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Dushanbe.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\playlist\vocaroo.luac.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\7-Zip\Lang\ar.txt.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Common Files\System\msadc\handler.reg.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\gu.pak.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\clock.js.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\currency.js.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\graph_up.png.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-spi-quicksearch.xml.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-threaddump.xml.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-coredump.xml.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring.xml.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jre7\lib\security\US_export_policy.jar.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Godthab.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Auckland.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxslt.dll.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Monterrey.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_divider_right.png.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\flyout.css.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\35.png.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-core.xml.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Games\Hearts\ja-JP\Hearts.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-loaders.xml.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Atlantic\Bermuda.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.lnk.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\meta\art\01_googleimage.luac.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_hail.png.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.xml.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-actions.jar.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\gadget.xml.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\msvcr100.dll.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mahe.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\meta\art\00_musicbrainz.luac.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vevay.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-settings.jar.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\ShvlRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jre7\lib\ext\access-bridge-64.jar.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Games\More Games\ja-JP\MoreGames.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe

"C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe"

Network

N/A

Files

memory/2036-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1163522206-1469769407-485553996-1000\desktop.ini.tmp

MD5 a3a783987e20c240e3fd6ff302f04c05
SHA1 ebb1365a0b5e0041b1c2a2f13b73968a6c78eb32
SHA256 6d831e8f0a0ec86f62f4ed0cf27a7cce52b7808f7a72f5decc3776dd1b1ab4b8
SHA512 3f21a1c3341cdc65e968019e1a1382f24187adb0d3daf6dd8976a7d04f0d792367fcd9c06e45520718a057c9b1a5dc5782032f012226d2487507eb8bcf46dafb

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 e7ea1ae43d20b772f5373732968864ff
SHA1 347902c7a9beaae22f6112b3b6cc7e2941141ec4
SHA256 171a10bd10f4d283de9d3328cc7bda70d8dc66dcc6f6d0d125a81506bbcdff15
SHA512 79d2f719801f08ef504d3c82e9b91bb7d4d716e967a93633cfb674325f7bf7183af943a930883fd2b279ff3eff1bdfcd141b6a45dfab98defe3dc7adaeefaaf6

memory/2036-71-0x0000000000400000-0x000000000040A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-13 00:48

Reported

2024-11-13 00:50

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

136s

Command Line

"C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe"

Signatures

Renames multiple (5271) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\Client\msvcr120.dll.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-core-timezone-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoCanary.png.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload\preloaded_data.pb.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\wxpr.dll.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.IsolatedStorage.dll.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\db2v0801.xsl.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ONFILTER.DLL.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\7-Zip\Lang\ga.txt.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\management\snmp.acl.template.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TAG.XSL.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\de.pak.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.dll.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Internet Explorer\de-DE\ieinstal.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\US_export_policy.jar.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\cpprestsdk.dll.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\OSFROAMINGPROXY.DLL.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.dll.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MML2OMML.XSL.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\zlibwapi.dll.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Algorithms.dll.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Classic.dll.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\bci.dll.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.VisualC.dll.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\security\java.policy.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-100.png.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelGlyph.16.White.png.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Watcher.dll.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationCore.dll.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationUI.dll.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\da.pak.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-process-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Subtle Solids.eftx.tmp C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe

"C:\Users\Admin\AppData\Local\Temp\97307a9a0bb3695fa17e107f7af2458d6249ca308c7f5493739b2606fa2f49e8.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

memory/2580-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3350944739-639801879-157714471-1000\desktop.ini.tmp

MD5 0f9a1b463cf03f8b4afbed896b7da099
SHA1 f7410eeed37a3fcd462c1ebea229c5a93a7e8c08
SHA256 6bf105799008a0347d6ef5ce6fd39143532e8d07e06f3e2a6f5029a8492b00c9
SHA512 f0f90064e935e1e5afcf78846edc192f0684ebdf03204c2958e069f8593cc4d84a96da648ee2e3603dcc16a6d84377eb38efe8baee27bfe44218d4100409ff41

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 6a52b47024ae767b4b7ac0eb5b4ebb38
SHA1 912494c588c8122cdab253e05804f8a6909fbd31
SHA256 cbb3aa78d4c8e977dccc26ba9bdce5e30ffec25eace5d31630c184f9cd77f1d8
SHA512 cce6aabfea6a7f04e7a881fa71c5c97ced4d87c735262b44c2a0f266c0b19a92fd6f30a7cc144f46d0e8b99677cedbcb019d3d7f6f7ff0571c2605243d05db4f

memory/2580-790-0x0000000000400000-0x000000000040A000-memory.dmp