Analysis
-
max time kernel
150s -
max time network
103s -
platform
windows11-21h2_x64 -
resource
win11-20250502-en -
resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system -
submitted
15/05/2025, 07:20
Static task
static1
Behavioral task
behavioral1
Sample
772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe
Resource
win11-20250502-en
General
-
Target
772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe
-
Size
543KB
-
MD5
0bd0c76c4ac975e58b0a42ae5379d4c3
-
SHA1
071c26f93f706b8ba90494e113f6841633306d10
-
SHA256
772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e
-
SHA512
25279040ca828171d8a0b8ad01cd118d7578d21fbfff2c354c075c514527650d67fda37328a899bf31acfef414313b5f01def5e598dbaf78f7b0ace1b92a4f17
-
SSDEEP
12288:9mN9Mttts+n8tGwXglfWF1wUcmN9Mttts+n8tGwXglfWF1wUl:9mNOttts+nKGwXgluF1wtmNOttts+nKZ
Malware Config
Signatures
-
Renames multiple (3866) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.CodeDom.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Banded Edge.eftx.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\7-Zip\Lang\az.txt.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.ReaderWriter.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterRegular.ttf.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationCore.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ReachFramework.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.Messages.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Reader.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\System.Windows.Forms.Design.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\d3dcompiler_47.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-0.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationProvider.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash.gif.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\libxml2.md.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jre-1.8\bin\j2gss.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.IsolatedStorage.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\PresentationUI.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\xerces.md.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\chrome.dll.sig.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\local_policy.jar.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsFormsIntegration.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ppd.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\microsoft shared\ink\gl-ES\tipresx.dll.mui.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Asn1.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Xaml.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ul-oob.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Mail.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\LINEAR_RGB.pf.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ppd.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\fxplugins.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Loader.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.CompilerServices.Unsafe.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Threading.AccessControl.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.Registry.AccessControl.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\7-Zip\Lang\pl.txt.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.ResourceManager.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe"C:\Users\Admin\AppData\Local\Temp\772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3468
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
544KB
MD54402736855ae34be7852266ddea3f943
SHA195aff737d3ce0b7127a1932b4bdd3943fb541822
SHA2563073db412f2448f51bffb0c5ff5d4eba21577ab12be3a10a9f26b8a0e2eda9ed
SHA5120ce07e94f9c92daac3e6d73d5996dacbbecfcbeadd5d6ef1344f2a3f49aedc82c1b730cd5b14bf5960a79b36ca8b630cbeb06fd9fc3be587b05309f18a24adce
-
Filesize
624KB
MD555e4d392afb0a8b7426c76b60fc4509b
SHA19a4f8ed47990d8d34f258b4d40cbe73840f515a2
SHA2563eaa84ac5b2b321ea66df3b18f7db4116123c8ea89d3e73d4053f13efb8eb54f
SHA5122d70ca8ddefff5289e2a643780bd0ab5a550119d3a23407eb8b2bb536067b002457eb30aad972ff5f86db0fb4decacbf54daeab14f9a24b50524a580e2ba24f9