Analysis
-
max time kernel
150s -
max time network
102s -
platform
windows11-21h2_x64 -
resource
win11-20250502-en -
resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system -
submitted
18/05/2025, 09:56
Static task
static1
Behavioral task
behavioral1
Sample
7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe
Resource
win11-20250502-en
General
-
Target
7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe
-
Size
6.4MB
-
MD5
24a1e4aa7392fae234e8b506018186e8
-
SHA1
3d552f7f4c85a044e2f15520a744596557572d40
-
SHA256
7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81
-
SHA512
b2e50c9be3569ddc7c1fd88c48a8ae89c47004022ed20f04baac9761089be86de0d4571a36785eefd2959fd05d9a0b566571572176cc34466fa3db3e62078e17
-
SSDEEP
98304:hfvhjurdSGgHjhDnWH5YgrMvglnLHenTKTkWwfku:hf143MtnOCg4IpLHeeTnwfku
Malware Config
Signatures
-
Renames multiple (404) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-datetime-l1-1-0.dll.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-locale-l1-1-0.dll.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore_amd64_amd64_6.0.2724.6912.dll.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\7-Zip\7z.exe.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\System\ado\adojavas.inc.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\System\ado\msader15.dll.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\7-Zip\Lang\cy.txt.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\7-Zip\Lang\el.txt.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\7-Zip\Lang\vi.txt.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\7-Zip\Lang\nb.txt.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\System\msadc\msadce.dll.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Extensions.dll.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\7-Zip\Lang\lt.txt.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clretwrc.dll.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\7-Zip\7-zip32.dll.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\7-Zip\Lang\tg.txt.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\7-Zip\Lang\ka.txt.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\7-Zip\Lang\br.txt.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\7-Zip\Lang\en.ttt.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tabskb.dll.mui.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\System\ado\msado21.tlb.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\7-Zip\Lang\co.txt.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.dll.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\CompleteGet.raw.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.StackTrace.dll.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe"C:\Users\Admin\AppData\Local\Temp\7af27a5eab054cbc72d9d785e91d01b8ea108f82a4631d9d4a31997fabbd9c81.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3000
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.4MB
MD57881c38eb4f5a641b04f6cb4eaa19461
SHA1fc4e6fbfa8bdc4a225d2a3375eb24a90fbe326b7
SHA2564aa3c0c30a2f3153301693229f12ab8d36adc5c723f9fe5916ad57059a5d550a
SHA51202b191366eef77fa324f92be199b3969f529d5127147a05544212577c83352741565f5016ef536ae2feecf060e39b4ae784e4816bb495785c5af5bd3c69cae05
-
Filesize
6.4MB
MD5ae2b93c173ba6cc7d8f2127eea5c636f
SHA1710394247eae81a7932e3af1b8fa0acfd5f2b473
SHA25620f720f08134b900596864410260a515d0247c40b25659489afb17f52cfc7a44
SHA512a1cd814856c9a6624298fc5dae43dceb73a2a782ec9016e37ea7178d33f3d8b7c2b7febe771c1524e07d896c6ebd7d637b22ee03293828c97377c9ba9a73041d