Analysis
-
max time kernel
104s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20250313-en -
resource tags
arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system -
submitted
02/04/2025, 02:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0cf5491278c7d87e8c3fc88c7f9f26ff.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
0cf5491278c7d87e8c3fc88c7f9f26ff.exe
-
Size
908KB
-
MD5
0cf5491278c7d87e8c3fc88c7f9f26ff
-
SHA1
db1d9f161f331d07bbb626acf7d4f8f6e1a2c742
-
SHA256
9ddb239d7c1ca00e5cf13cd6b1f816bdba30792b1f26cef2ca807336bd0b3802
-
SHA512
6bda8ea0fe42eb032d0c81e49e7c1a3d8d321185615bae41aca265b53d63191274c8ec6b646663668ab78d4b4ed5986ca73fcd85c2e212cde075d324f5a2c66f
-
SSDEEP
6144:xcQQbTJ0huBKxmueLQ320SlmQ2Gz3bJo47/T8MF3KSUEtQGG4P4T:bqLQ320SlmQ2GzW47vKSry14P
Malware Config
Signatures
-
Detects Rhysida ransom note 1 IoCs
resource yara_rule behavioral1/files/0x0007000000024248-4.dat family_rhysida_ransomnote -
Rhysida
Rhysida is a ransomware that is written in C++ and discovered in 2023.
-
Rhysida family
-
Renames multiple (9668) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Deletes itself 1 IoCs
pid Process 6804 rundll32.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\CriticalBreachDetected.pdf 0cf5491278c7d87e8c3fc88c7f9f26ff.exe -
Loads dropped DLL 1 IoCs
pid Process 6804 rundll32.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\convertpdf-selector.js.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\CriticalBreachDetected.pdf 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nl-nl\ui-strings.js.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\identity_proxy\canary.identity_helper.exe.manifest.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\CriticalBreachDetected.pdf 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Controls\EndOfLife\CriticalBreachDetected.pdf 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\it-it\ui-strings.js.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\hu-hu\ui-strings.js.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\es\CriticalBreachDetected.pdf 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File created C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\CriticalBreachDetected.pdf 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File created C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\CriticalBreachDetected.pdf 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\ui-strings.js.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_icons_retina.png.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\CriticalBreachDetected.pdf 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File created C:\Program Files\VideoLAN\VLC\locale\pa\CriticalBreachDetected.pdf 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\CriticalBreachDetected.pdf 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_hiContrast_bow.png.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\CriticalBreachDetected.pdf 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ar-ae\CriticalBreachDetected.pdf 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fr-fr\CriticalBreachDetected.pdf 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\css\main-selector.css.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MyriadPro-Regular.otf.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ul-oob.xrm-ms.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\variant.js.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_proxy\win11\identity_helper.Sparse.Dev.msix.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Locales\sr-Cyrl-BA.pak.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART11.BDR.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\stickers\word_art\CriticalBreachDetected.pdf 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\AppxMetadata\CriticalBreachDetected.pdf 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Lumia.MagicEdit\Pages\CriticalBreachDetected.pdf 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sk-sk\CriticalBreachDetected.pdf 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-tw\CriticalBreachDetected.pdf 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ul-oob.xrm-ms.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\CriticalBreachDetected.pdf 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\CriticalBreachDetected.pdf 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\ui-strings.js.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-140.png.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk\CriticalBreachDetected.pdf 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\CriticalBreachDetected.pdf 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\te-IN\CriticalBreachDetected.pdf 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\css\main.css.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\eu-es\ui-strings.js.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\IRIS.INF.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\vlc.mo.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\CriticalBreachDetected.pdf 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ms_get.svg.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-ae\ui-strings.js.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\CriticalBreachDetected.pdf 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ppd.xrm-ms.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_rename_18.svg.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\es-es\ui-strings.js.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\bun.png.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\CriticalBreachDetected.pdf 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Locales\km.pak.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\BIN\CriticalBreachDetected.pdf 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ul-oob.xrm-ms.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\aic_file_icons.png.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ro-ro\ui-strings.js.rhysida 0cf5491278c7d87e8c3fc88c7f9f26ff.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4064 0cf5491278c7d87e8c3fc88c7f9f26ff.exe 4064 0cf5491278c7d87e8c3fc88c7f9f26ff.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4064 wrote to memory of 6804 4064 0cf5491278c7d87e8c3fc88c7f9f26ff.exe 103 PID 4064 wrote to memory of 6804 4064 0cf5491278c7d87e8c3fc88c7f9f26ff.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\0cf5491278c7d87e8c3fc88c7f9f26ff.exe"C:\Users\Admin\AppData\Local\Temp\0cf5491278c7d87e8c3fc88c7f9f26ff.exe"1⤵
- Drops startup file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\SYSTEM32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp/tmpf193.dll,run C:\Users\Admin\AppData\Local\Temp\0cf5491278c7d87e8c3fc88c7f9f26ff.exe2⤵
- Deletes itself
- Loads dropped DLL
PID:6804
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
111KB
MD549379b7b592a53fba1af809f38e0c8be
SHA1dace11e0bad3da3a6315ed6e72e66dce004df13d
SHA25620de3fa257de804c635184416d72e0b941e4b390a7c34f5a240aeaa5f5ef67eb
SHA512ea88fdeb46ae9435524975ee52e80210b56b9c4c974018736602804bbadc7b3a7d441fd550c0113c628407f6167995644d6e7dda2b4af835134fd0227f771a4b
-
Filesize
2KB
MD5634a9af8d3f2fa0d38820d577fb0fbeb
SHA1cd6e84a3c4f81fc9df8b82449db8b2e87130e3fd
SHA256c9920e995fbc98cd3883ef4c4520300d5e82bab5d2a5c781e9e9fe694a43e82f
SHA512abca2e016ff5a53395f95ba75c96f5bfa102086e92a8e2647bd2584a75e4a81a59596848d1abfab8e37981a6adb021a35074d4dc99868cc30c9c4e2a4666c50a