Malware Analysis Report

2024-12-07 09:59

Sample ID 241114-eqmb1avbnk
Target f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132
SHA256 f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132

Threat Level: Likely malicious

The file f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132 was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (4608) files with added filename extension

Renames multiple (3283) files with added filename extension

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-14 04:08

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-14 04:08

Reported

2024-11-14 04:11

Platform

win7-20240903-en

Max time kernel

150s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe"

Signatures

Renames multiple (3283) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jre7\lib\zi\Africa\Abidjan.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.bat.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libvpx_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lv.pak.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Knox.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.VisualC.STLCLR.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\UnregisterBlock.3gpp.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Glace_Bay.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Nauru.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libuleaddvaudio_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\msinfo32.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Port_of_Spain.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1655.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\net.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IpsMigrationPlugin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs.xml.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Design.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ulaanbaatar.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkHandle.png.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_xml.luac.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\glib-lite.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.zh_CN_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\cs.pak.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Mozilla Firefox\browser\features\[email protected] C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\demux\libdemuxdump_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-uisupport.jar.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfontj2d.properties.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jre7\lib\jfr\profile.jfc.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jre7\bin\glib-lite.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\SystemV\HST10.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Toronto.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-windows.xml.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jre7\bin\jfxwebkit.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Halifax.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.DataSetExtensions.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\include\classfile_constants.h.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Edmonton.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Goose_Bay.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Midway.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\bundles.info.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-services.xml.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Winnipeg.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Speech.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libspudec_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\MET.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\ir.idl.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Chihuahua.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-util.xml.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe

"C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe"

Network

N/A

Files

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 dc7d568ac176cb74a6722516ba4cc14d
SHA1 a4b7480094af1ec190b7645acc31fab245b44130
SHA256 cf243aee0cbe6dd37119db8d449f63ed04c2bebeaaeba364cb2b1d12760859de
SHA512 5c33f801d283d19290f74891c362d995c20816468e305ed2f9c52f24221cdb80d2f127f03487aa84f09906640cb011342e8a4e9a8f494675a5ff99e164638279

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

MD5 1125f4896b4f5ae895a64f9d99dc13c4
SHA1 e8a80b966e00b6861e5c1f2802a2119c6e3c3464
SHA256 eee9c7a6444fd15b8e79e9f8d4888cdeeef129af0f8f080566238ec447c89cf2
SHA512 588e1261b8d59cf8ad1f6e6876281791d69be83b68bf9b086b2bee50268b7b65c1417536eaa566650c438bf1510c6debe8c0da90c0d6fd9592fedd61342f5aa1

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-14 04:08

Reported

2024-11-14 04:11

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe"

Signatures

Renames multiple (4608) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationNative_cor3.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\local_policy.jar.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Loader.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.CoreLib.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationProvider.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.XmlSerializers.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\tracedefinition130.xml.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PenImc_cor3.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Serialization.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Dynamic.Runtime.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\7-Zip\7-zip.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.ServicePoint.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\psfont.properties.ja.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-140.png.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.XDocument.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jdk-1.8\include\jvmti.h.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\7-Zip\Lang\th.txt.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationCore.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-environment-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONDIRECTX.DLL.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\resource.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\t2k.dll.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TITLE.XSL.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt.tmp C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe

"C:\Users\Admin\AppData\Local\Temp\f20f4bdaf9d27c035ad97e9962ce6a5c4ee2586b4e1eda841d60d008f5ee1132.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

C:\$Recycle.Bin\S-1-5-21-2437139445-1151884604-3026847218-1000\desktop.ini.tmp

MD5 ad04173b5a3f086f1deb8ba55a3aa35d
SHA1 551639a0f7a9645017ca4c423911025c703d4aba
SHA256 209ffc4e3965ba71f2db18eed6c04c4a1252e196892e727d04b21ca5a0b7bfa1
SHA512 8eb75b0e12565aa4e4f403ab4c2f3236a493f89b68dc1b6080a4c4fa847b4f87cf331ee31ca9e3908d819cf674aff0107d791946efdbc2347be92e198435b420

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 c4e434ee8b8709fc3152e7ac93282ae3
SHA1 77157f00904dfaaaa32ec74b3aeb73dd48c7ccf7
SHA256 8dd402f8acc7419f449b2432160354d630e3c317b879ab997c970b562f932285
SHA512 fe49bfe7c90612de9033b0888dcfd24cc405357b9bc768f0f2637b5031b41c59a442b0e02c6a4b874ea3d323c57900f806ea84dc225c972f708b9b3f10e4069d