Malware Analysis Report

2024-12-07 09:57

Sample ID 241114-d7jf1atkdt
Target e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299
SHA256 e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299
Tags
upx discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299

Threat Level: Likely malicious

The file e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299 was found to be: Likely malicious.

Malicious Activity Summary

upx discovery ransomware

Renames multiple (969) files with added filename extension

Renames multiple (4655) files with added filename extension

UPX packed file

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-14 03:38

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-14 03:38

Reported

2024-11-14 03:41

Platform

win7-20241010-en

Max time kernel

150s

Max time network

19s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe"

Signatures

Renames multiple (969) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\7-Zip\Lang\es.txt.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Anchorage.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\7-Zip\Lang\br.txt.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-5.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\7-Zip\Lang\lv.txt.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\El_Aaiun.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Eirunepe.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jakarta.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+12.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\7-Zip\Lang\ja.txt.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Havana.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vevay.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Internet Explorer\pdm.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Regina.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\DVD Maker\it-IT\WMM2CLIP.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\management.properties.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guyana.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\DVD Maker\ja-JP\WMM2CLIP.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\7-Zip\7z.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\7-Zip\Lang\sk.txt.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_shmem.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Caracas.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\nio.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\cursors.properties.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Edmonton.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Common Files\System\ado\msado26.tlb.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ur.pak.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsoundds.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tunis.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe

"C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe"

Network

N/A

Files

memory/2336-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3692679935-4019334568-335155002-1000\desktop.ini.tmp

MD5 d6adebd6d358a908cef23a010cd48c4b
SHA1 b6f349324f0cff817c3b87b04bf261793b2f4dee
SHA256 a120e5ef7404a4972533b68bfdc17b1b4dcdb2ab668eab432c09fd53f6f0819f
SHA512 fc4cfd12fc02043db3eafce32ce29ddef82f50526ca4db036aa5634010b3c61fdba63a87500f840033e114b6d55350cf4d23ae0345afc2cb15e92090b26eadd0

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 b8c2cc2283b8775432fa217f3a699c1c
SHA1 a32b59f7e546210cea47e2198b639341d7bb043b
SHA256 c56113977a5e21ad2d611147b3862bbc3de133f8312c9d0acbdf6f6d075cc920
SHA512 495a1fc1c1191d0cd79fe21f4293fd1b3936b14a345214f1974d77381a1eccf204b006a02684c0c43b215e3032335ac7592a2591c25fe1d69648d5bc5f125d5c

memory/2336-26-0x0000000000400000-0x000000000040B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-14 03:38

Reported

2024-11-14 03:41

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

137s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe"

Signatures

Renames multiple (4655) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationProvider.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Specialized.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Internet Explorer\sqmapi.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2String.XSL.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\sunec.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\7-Zip\Lang\fr.txt.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-environment-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office-client15.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT.HXS.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Sybase.xsl.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSOSTYLE.DLL.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightRegular.ttf.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Spatial.NetFX35.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Common Files\System\ado\msado28.tlb.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Thread.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8.mp4.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwritash.dat.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\external_extensions.json.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Core.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\7-Zip\7-zip32.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\classlist.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Algorithms.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.Vectors.dll.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngcc.md.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe.tmp C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe

"C:\Users\Admin\AppData\Local\Temp\e42f5b504f58b918cd8024124176da1d2f1f86d0482699aaf1bc146b5571b299.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 24.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/3436-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-4089630652-1596403869-279772308-1000\desktop.ini.tmp

MD5 a30f6f9e8bf92fa6f9f082dfe3483230
SHA1 578295ae8999bf73a51a7f0d30a0a62ff806054a
SHA256 63bef7e78dac675d4318716cbf2cf413c2aa81e613b912ba8056628ef30f7daf
SHA512 b5ad734863df4eace565a6a493801de87c853b5c182b2433ddc873d45e4645560e3dda1b4210350b6d108c871021b3b2bdb1f16f45f0251538be29ace8ec35df

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 558d7aa01fce4cc868dd535b84b556aa
SHA1 bd9f7068c25161f5c27038aa2b5195280e58d4e0
SHA256 43219bd9382333b185bba966635d9ebc4ec85d55656da76acb4c490a460e60c8
SHA512 7c9c40db07aa3ccc31d6c85b2d1a72a5d14092f9d76207219f69e64df404d8dd7fc2d5636b03366443e665000c7178e3d4969528e0d1b2112d23b194ba96be44

memory/3436-648-0x0000000000400000-0x000000000040B000-memory.dmp