Analysis
-
max time kernel
150s -
max time network
103s -
platform
windows11-21h2_x64 -
resource
win11-20250502-en -
resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system -
submitted
15/05/2025, 07:23
Static task
static1
Behavioral task
behavioral1
Sample
772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe
Resource
win11-20250502-en
General
-
Target
772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe
-
Size
543KB
-
MD5
0bd0c76c4ac975e58b0a42ae5379d4c3
-
SHA1
071c26f93f706b8ba90494e113f6841633306d10
-
SHA256
772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e
-
SHA512
25279040ca828171d8a0b8ad01cd118d7578d21fbfff2c354c075c514527650d67fda37328a899bf31acfef414313b5f01def5e598dbaf78f7b0ace1b92a4f17
-
SSDEEP
12288:9mN9Mttts+n8tGwXglfWF1wUcmN9Mttts+n8tGwXglfWF1wUl:9mNOttts+nKGwXgluF1wtmNOttts+nKZ
Malware Config
Signatures
-
Renames multiple (3931) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.ServicePoint.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\PresentationCore.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\System.Windows.Controls.Ribbon.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\deployJava1.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ppd.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ppd.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Windows.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationFramework.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\wpfgfx_cor3.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Globalization.Calendars.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jfr.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-pl.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Primitives.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationTypes.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ja.properties.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-pl.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Formatters.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\th.pak.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\7-Zip\Lang\de.txt.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationUI.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\vcruntime140_cor3.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\.version.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Xaml.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jdk-1.8\lib\javafx-mx.jar.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\System.Windows.Controls.Ribbon.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\System.Windows.Forms.Primitives.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsFormsIntegration.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsBase.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\ReachFramework.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Primitives.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Compression.Native.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-pl.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\PresentationUI.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ppd.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ul-oob.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Web.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClient.resources.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Resources.Extensions.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Extensions.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\chrome_elf.dll.tmp 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe"C:\Users\Admin\AppData\Local\Temp\772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3852
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
544KB
MD5e25767c88994eb865801aa87bfcc2b76
SHA17eafe28930bb63e523fb2048e2a3268a1d6bc5cb
SHA25604c73b8a03546a64c1bc5ced218a8700752a1a80c25bbee65d5f987eadb289a1
SHA51272449d410e66e0af4856b77e5d4b7462e5592c92cc510308c622681ea74f6613f02aaae17b86944280577c8a4f6c74764a861c6d8eba7529eb08113fd1f41e47
-
Filesize
625KB
MD503c53f6d54e9fb57c4f2382bc9ca205f
SHA1df430703a0c11afa500b35092a7d0f823242b083
SHA256501cb01d57cdb95968747ff540f5f1e4e9d1f55182917bb9a86276e212e75b4b
SHA51213e8bea849a7c6d8f43afaec85857fdeca847cbd71555c581751946e9342a05153169c9ce3141cb5ce0b4038fe8455bf9da0c36816a7f6cf37345c3736572924