Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2025, 07:20
Static task
static1
Behavioral task
behavioral1
Sample
772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe
Resource
win11-20250502-en
General
-
Target
772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe
-
Size
543KB
-
MD5
0bd0c76c4ac975e58b0a42ae5379d4c3
-
SHA1
071c26f93f706b8ba90494e113f6841633306d10
-
SHA256
772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e
-
SHA512
25279040ca828171d8a0b8ad01cd118d7578d21fbfff2c354c075c514527650d67fda37328a899bf31acfef414313b5f01def5e598dbaf78f7b0ace1b92a4f17
-
SSDEEP
12288:9mN9Mttts+n8tGwXglfWF1wUcmN9Mttts+n8tGwXglfWF1wUl:9mNOttts+nKGwXgluF1wtmNOttts+nKZ
Malware Config
Signatures
-
Renames multiple (3484) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ul-oob.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jre-1.8\bin\j2gss.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrdeulm.dat.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\System.Windows.Input.Manipulations.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jfxmedia.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxslt.md.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140_1.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-pl.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ppd.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationUI.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationFramework-SystemXml.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\ExportConvertFrom.cfg.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jdwp.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Writer.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\System\ado\msador28.tlb.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Extensions.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\thaidict.md.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-phn.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Buffers.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\WindowsBase.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\PrivacySandboxAttestationsPreloaded\manifest.json.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Grayscale.xml.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationUI.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\asm.md.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jre-1.8\lib\currency.data.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\7-Zip\Lang\hr.txt.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-interlocked-l1-1-0.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jre-1.8\lib\security\cacerts.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe"C:\Users\Admin\AppData\Local\Temp\772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1484
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
544KB
MD5cbca8c7e5fd0e7a114ba77616b73ef83
SHA1615f07b4d0e162530984c5e7b0cda8c2df9939e8
SHA256899663851789fe52ea33d03084314b877c128960416665369775e2bb7267c59d
SHA512ca0ffaa0f9a793bdde2e6c24212760fb37fce4a1e6f68ecb2b9139e9b1a6e5b96c02d22306169896493c9612d425342166418a241383001e1e2d16ff6ef5e8a5
-
Filesize
625KB
MD513897578023e0f754e6c1d2c08e27f45
SHA18cf3247d2fe1e9935d8bfe8138cea871441ba43f
SHA256979a910f920b0294d8e3e1420dfc5615bf0971ef67a63bd120640bc241295477
SHA5121c9bc519286f0744ef7fb1d07654003fc1d2c13971420040cd8bde3fb8c67c1df281f1339a201695d645fd62e01c358558648c3d2558f14c684a44b63d2fcefe