Analysis
-
max time kernel
150s -
max time network
112s -
platform
windows11-21h2_x64 -
resource
win11-20250502-en -
resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system -
submitted
15/05/2025, 07:20
Static task
static1
Behavioral task
behavioral1
Sample
7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe
Resource
win11-20250502-en
General
-
Target
7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe
-
Size
643KB
-
MD5
8cd2f51cb8087bba667d4a0f9df7cfa7
-
SHA1
ce3bf60eb2723ca3d145881124dcf4b5ba3b15bc
-
SHA256
7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981
-
SHA512
a91ae71b3c46adce9b1543fb12431775a420e508770bbd5bc5e490994bb5433773a7e0bffa8d2ee98e42b190021d0487cdf90a3fdb2a605bd7aa9551c39e247b
-
SSDEEP
6144:Ny3rYMv0pilFvAfTtYHHu8C/TXmrILY3rYMv0pilFvAfTtYHHu8C/TXmrIL0:wvvUcFvACw7XmrnvvUcFvACw7Xmr3
Malware Config
Signatures
-
Renames multiple (3205) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\7zFM.exe.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.wordmui.msi.16.en-us.xml.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-oob.xrm-ms.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ppd.xrm-ms.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\j2pcsc.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-stdio-l1-1-0.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange Red.xml.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet.xml.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow.xml.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClientSideProviders.resources.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Java\jre-1.8\lib\jfr.jar.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-phn.xrm-ms.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ul-oob.xrm-ms.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ppd.xrm-ms.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-2-0.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Serialization.Json.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\WindowsBase.resources.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\ReachFramework.resources.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Java\jdk-1.8\jmc.txt.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.X509Certificates.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Primitives.resources.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationProvider.resources.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Java\jre-1.8\bin\resource.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Java\jre-1.8\lib\logging.properties.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ppd.xrm-ms.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ppd.xrm-ms.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationUI.resources.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\fi.pak.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\lv.pak.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ul-oob.xrm-ms.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ppd.xrm-ms.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Private.Uri.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Java\jre-1.8\bin\dt_shmem.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Grayscale.xml.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\ReachFramework.resources.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\lcms.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ppd.xrm-ms.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationCore.resources.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\UIAutomationProvider.resources.dll.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe File created C:\Program Files\Internet Explorer\images\bing.ico.tmp 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe"C:\Users\Admin\AppData\Local\Temp\7b9536e0c2d8342c3091c372733088764bbf241a89d6d64a07a711a315ff2981.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2220
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
644KB
MD58324d15d6ef09bd204fa32c9a3e8f52a
SHA1a135f494418dfb85b7d6054316c029ca4b1c47ff
SHA2560cb9ca190b601cde7b8b320e856117faa2950458fc00cb144fa0566777e6b208
SHA512b3e537b20e1b44b233440d8c81952995f433677e0765f1033de7c2ccd400da9374ff2d444de0018c10636f356177473ca96f8b09f2207a8c597f6615e41b8d0f
-
Filesize
729KB
MD54184a8f44d758afd6fa68e30dec4954e
SHA13e66e55455a882ac005705aef2e1853a0035acfb
SHA2563835b0438469f92f1f91b9a851f36502c9d1c630bbdb84402e7f1600819c0bd1
SHA51227c0a743e1803f4fd79c2baa10b29473fb98f2577de8051a837813b0f153c027d8a4b5374ca82b637ca4ab6767762000d97aba95e9911a2e87efe3216539bc69