Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2025, 07:23
Static task
static1
Behavioral task
behavioral1
Sample
772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe
Resource
win11-20250502-en
General
-
Target
772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe
-
Size
543KB
-
MD5
0bd0c76c4ac975e58b0a42ae5379d4c3
-
SHA1
071c26f93f706b8ba90494e113f6841633306d10
-
SHA256
772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e
-
SHA512
25279040ca828171d8a0b8ad01cd118d7578d21fbfff2c354c075c514527650d67fda37328a899bf31acfef414313b5f01def5e598dbaf78f7b0ace1b92a4f17
-
SSDEEP
12288:9mN9Mttts+n8tGwXglfWF1wUcmN9Mttts+n8tGwXglfWF1wUl:9mNOttts+nKGwXgluF1wtmNOttts+nKZ
Malware Config
Signatures
-
Renames multiple (3578) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\legal\javafx\directshow.md.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-environment-l1-1-0.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\icu_web.md.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-pl.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\7-Zip\7z.sfx.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Private.Uri.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Controls.Ribbon.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\WindowsFormsIntegration.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ppd.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ul-oob.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-pl.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jre-1.8\bin\fxplugins.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\7-Zip\Lang\eu.txt.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrespsh.dat.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jre-1.8\bin\jawt.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ul-oob.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-utility-l1-1-0.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Controls.Ribbon.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-phn.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClient.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationFramework.Classic.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jre-1.8\lib\ext\access-bridge-64.jar.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ul-oob.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationCore.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l2-1-0.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-process-l1-1-0.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-phn.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\System.Xaml.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\WindowsFormsIntegration.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-oob.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\System.Windows.Controls.Ribbon.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jre-1.8\lib\jce.jar.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\Office16\OSPP.VBS.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-pl.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\wpfgfx_cor3.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.ProtectedData.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\Microsoft.Win32.Registry.AccessControl.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\VisualElements\LogoBeta.png.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jre-1.8\lib\management-agent.jar.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.NameResolution.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.Win32.Registry.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Xaml.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe"C:\Users\Admin\AppData\Local\Temp\772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5080
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
544KB
MD553f6a9a808efa864ccf407a184e464b8
SHA115991e0643f3bb25946789bed30915ca656f524c
SHA256913fa4bd06701fb16e96878a8c13cee30dea8de164f500e29ed865acb17ecf35
SHA51223b469963613af0c486acc1f953fe635888a866c7ecc74481566fa73c548a7f174860b0e52609034a5f29d5af4cccdee611ef5b043c0b11115cdf6594cb9bdb8
-
Filesize
625KB
MD5fb5558290b8f5a4df6fb593b30c05a43
SHA13088ed96825a308930d710027722e4311c5a4bb5
SHA25663e7320b14e884e121b53d94911eeda99fd409b5b590c4a603cae12db3116cea
SHA51221657824bb508d91435535db9a4fb4926227e65ef736942b7d58f4200e71dfa87bf9118be75bf2cdfc5ccaf42b60533f42e99c9b64f8b3f0c116e5995cb532b5