Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2025, 07:20
Static task
static1
Behavioral task
behavioral1
Sample
7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe
Resource
win11-20250502-en
General
-
Target
7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe
-
Size
643KB
-
MD5
8cd2f51cb8087bba667d4a0f9df7cfa7
-
SHA1
ce3bf60eb2723ca3d145881124dcf4b5ba3b15bc
-
SHA256
7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981
-
SHA512
a91ae71b3c46adce9b1543fb12431775a420e508770bbd5bc5e490994bb5433773a7e0bffa8d2ee98e42b190021d0487cdf90a3fdb2a605bd7aa9551c39e247b
-
SSDEEP
6144:Ny3rYMv0pilFvAfTtYHHu8C/TXmrILY3rYMv0pilFvAfTtYHHu8C/TXmrIL0:wvvUcFvACw7XmrnvvUcFvACw7Xmr3
Malware Config
Signatures
-
Renames multiple (3021) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-2-0.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Extensions.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.NETCore.App.deps.json.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11wrapper.md.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-oob.xrm-ms.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\7-Zip\Lang\ky.txt.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.AccessControl.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Windows.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Tasks.Dataflow.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwritash.dat.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\Microsoft.VisualBasic.Forms.resources.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\ar.pak.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Java\jdk-1.8\bin\msvcp140.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Metadata.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\PresentationUI.resources.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\bci.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\7-Zip\Lang\pl.txt.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceProcess.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Accessibility.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\PresentationFramework.resources.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Java\jre-1.8\bin\decora_sse.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Java\jre-1.8\bin\jsdt.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_es.properties.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\WindowsBase.resources.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\os_update_handler.exe.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr\profile.jfc.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.dcfmui.msi.16.en-us.xml.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ppd.xrm-ms.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.Primitives.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.XPath.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Threading.AccessControl.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\System.Windows.Controls.Ribbon.resources.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Internet Explorer\ExtExport.exe.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-time-l1-1-0.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Java\jdk-1.8\jre\LICENSE.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.16.xml.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Organic.thmx.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ul-oob.xrm-ms.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Tasks.Extensions.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.resources.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe"C:\Users\Admin\AppData\Local\Temp\7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4204
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
644KB
MD55116df90a339a96989ac71fd25c143db
SHA1a90b8cf17ff6da0fd552dad5b29568a44471a097
SHA25676736ffca644d9fd358981bc31141e4d32b7c7a943598c0f50adcb27a76d1b7d
SHA51250c89f11e555f29126cb2db27dd2b6f36ee4319be7bd1c8d45b6842fff7177343f4ee476a8c99ce6e038db0803b3bb6aea67e518ad7f06cb168a928154597767
-
Filesize
729KB
MD55b2d5474d68b2db0d5194cf8ee72ff89
SHA15b86175da30270320257107329263b8c7ed0000a
SHA25616fd192f9552111589d2277f12f3fec00b81b0bb9270f05f4618b7ba07aa467d
SHA5126df9baad25699187d404014dfb157a784b7706b6653673933768dfb3a67c7627aa4dc1c92142bfc973afd73df9142aeb64d0026b3e4057e0a11970f1ef74aa28