Analysis Overview
SHA256
44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5
Threat Level: Likely malicious
The file 44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5 was found to be: Likely malicious.
Malicious Activity Summary
Renames multiple (5240) files with added filename extension
Drops file in Program Files directory
System Location Discovery: System Language Discovery
Unsigned PE
MITRE ATT&CK
Enterprise Matrix V16
Analysis: static1
Detonation Overview
Reported
2025-05-15 07:23
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2025-05-15 07:23
Reported
2025-05-15 07:26
Platform
win10v2004-20250502-en
Max time kernel
150s
Max time network
143s
Command Line
Signatures
Renames multiple (5240) files with added filename extension
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Design.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Xaml.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsBase.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-pl.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-process-l1-1-0.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\1033\SLINTL.DLL.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\ONPPTAddin.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN121.XML.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsFormsIntegration.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClient.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\System.Xaml.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ul-oob.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Authorization.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\MINSBROAMINGPROXY.DLL.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsBase.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7FR.LEX.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MSJHBD.TTC.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-convert-l1-1-0.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Xaml.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\PresentationCore.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SQLENGINEMESSAGES.XML.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Windows.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-localization-l1-2-0.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-string-l1-1-0.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\1033\TellMeWord.nrr.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Localytics.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-filesystem-l1-1-0.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Luna.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ul-oob.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUIFormulaBarModel.bin.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\7-Zip\Lang\bn.txt.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\rsod\osmux.x-none.msi.16.x-none.tree.dat.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Common Files\System\wab32res.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.RuntimeInformation.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ul-oob.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelGlyph.16.White.png.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Collections.Specialized.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ul-oob.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN095.XML.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\WebView2Loader.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemDrawing.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Forms.dll.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
| File created | C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe
"C:\Users\Admin\AppData\Local\Temp\44a5ca27c9c1f9dad1e2b211968da02292c23c182be75987050c2bc3947f99e5.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 150.171.28.10:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| FR | 142.251.37.35:80 | c.pki.goog | tcp |
Files
C:\$Recycle.Bin\S-1-5-21-3342576763-1998465526-3870295501-1000\desktop.ini.tmp
| MD5 | 931a716a61c724444a82bc87a1cb8851 |
| SHA1 | 2fbc801ee05635ab8756728c331fad5cb1a9c374 |
| SHA256 | 092ff1e0113e5409f0a3cc3b3bb2ff4e6577eaafbb5683a91076650094cedf9e |
| SHA512 | 6083531a3f3803bc24c74fcd34ca8fc18fdc5e33b2ff3712ca03d52ae5299f044f48b1ae8f5ab8630ff025dee87786e8a8aeb5ff1c5dcb754e1be3eb316b3748 |
C:\fa79de221d524b769d0447\2010_x64.log.html.tmp
| MD5 | 578e6ffc7d9bb257009bf6e41b56a64b |
| SHA1 | 785d234b70b19bb6fd0b20abd2eb935e4b7b86d1 |
| SHA256 | 72a627c7b2a7069540dc6af0da42195756e6b8368eed6b7ea25b5421811d98cf |
| SHA512 | 4dbf5e6df341fc091b15c6edb0ac3285952e33341f0425247bda52fb85dbef49469531f4010e5cf28e21ca61e08b1272dac99a2c181d4ca2b2f6132133955e19 |