Analysis
- max time kernel
149s - max time network
102s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system - submitted
18/05/2025, 07:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe
Resource
win10v2004-20250502-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe
Resource
win11-20250502-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe
- Size 57KB
- Sample250518-jvsrssxqs7
- SHA256 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a
- MD5 4a793b1868a477a3a38b073ece8cb4ce
- SHA1 98f89d1dd33138253042fd1dd664202f57ca5ade
- SHA512 528294846654ebc5f2449a7923ff96df1a9f73afbd820f0e1989748301a500d9bafe3127e756902e1d3ca1fe5075f02cc8f6386e32dd5b5cbe2fdd4267cdb4a0
- SSDEEP 768:s7BlpppARFbhdLz8ae+rOn8ae+rOUfbm491Z4FLz8ae+rOn8ae+rOUfbm49XpP:s7ZppApdIIUfbmuGIIUfbmIpP
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5327) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\is.txt.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.dll.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClient.resources.dll.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ppd.xrm-ms.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Xaml.resources.dll.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-oob.xrm-ms.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\msipc.dll.mui.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore_amd64_amd64_7.0.1624.6629.dll.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.FileSystem.Watcher.dll.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_ko.properties.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ppd.xrm-ms.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-pl.xrm-ms.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul-oob.xrm-ms.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.dll.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-phn.xrm-ms.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Microsoft Office\root\Office16\AugLoop\bundle.js.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL058.XML.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.CSharp.dll.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Xaml.resources.dll.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-1-0.dll.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.powerpointmui.msi.16.en-us.xml.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ppd.xrm-ms.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\7-Zip\Lang\be.txt.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationUI.resources.dll.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\ReachFramework.resources.dll.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemuiset.msi.16.en-us.xml.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG.HXS.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-80.png.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ppd.xrm-ms.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINCORE.DLL.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Mail.dll.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\WPGIMP32.FLT.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\Keywords.HxK.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsFormsIntegration.resources.dll.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ppd.xrm-ms.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL097.XML.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NameResolution.dll.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.NETCore.App.runtimeconfig.json.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationUI.resources.dll.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ppd.xrm-ms.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ul-oob.xrm-ms.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-180.png.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\7-Zip\Lang\pl.txt.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\DirectWriteForwarder.dll.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Pkcs.dll.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-pl.xrm-ms.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\ACEODBCI.DLL.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\UIAutomationTypes.resources.dll.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.OLE.Interop.dll.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-process-l1-1-0.dll.tmp 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe"C:\Users\Admin\AppData\Local\Temp\607b7b9c716367bd62e2c706799510d1e0770d3e636022ebdd34c9e687b44e8a.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1448
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-330179853-1108322181-418488014-1000\desktop.ini.tmp
- Size 57KB
- SHA256 08229956b546d93b261ab7cc4b6f91b3dc760c10d6d23e148dfce91ab9ed3f00
- MD5 81be448a00799ef2dd0d943af13f47cd
- SHA1 81870e69f502a4516f725a97338497c16287a22e
- SHA512 6ca237ad49f1ca9558187ee7cc5ca1ab334ffaad6c4de72a8bbdc6bbefe9a6af85f72283fa1d0dd1f5b2f9c000e56ec4f8d4a84e6cff598293b39cb4b4f36f1d
- SSDEEP 768:s7BlpppARFbhdLz8ae+rOn8ae+rOUfbm491Z4FLz8ae+rOn8ae+rOUfbm49Xp2:s7ZppApdIIUfbmuGIIUfbmIp2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\b5678467481f56688dc2ce816954\2010_x86.log.html.tmp
- Size 138KB
- SHA256 0c4793654b544edf9a595b1d2962ffe26f4ea4a9caf83d529e62e6581a632e2a
- MD5 6f674b81921fdd9722135a209d84d600
- SHA1 59313e24026ad10ede2800c202a53bed20f0a972
- SHA512 85cbabf74064562c23387525d5d605932adbe1583d164c0b04d7f4a818678c906b51965f8b7b2121ba8c49833850a405cc3e5748adeca5c934ea2271ce6bdc5f
- SSDEEP 1536:s7ZppApdIIUfbmuGIIUfbmIpaoslqVf5oPti/k:spWpFoslqVfePti/k
- MD5 SHA1 SHA512 SSDEEP