Malware Analysis Report

2025-06-16 06:31

Sample ID 250515-h72d2aap8x
Target 4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4
SHA256 4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4

Threat Level: Likely malicious

The file 4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4 was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (5200) files with added filename extension

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-05-15 07:23

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-05-15 07:23

Reported

2025-05-15 07:26

Platform

win10v2004-20250502-en

Max time kernel

149s

Max time network

135s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe"

Signatures

Renames multiple (5200) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\cs.pak.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\SharePointPortalSite.ico.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Java\jdk-1.8\lib\ir.idl.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Core.dll.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Primitives.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\AppvIsvSubsystems64.dll.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\rsod\office32mui.msi.16.en-us.tree.dat.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL103.XML.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Numerics.dll.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Private.CoreLib.dll.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri.xml.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-180.png.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\WEBSANDBOX.DLL.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\7-Zip\Lang\eu.txt.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationCore.dll.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.AnalysisServices.AdomdClientUI.dll.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.tree.dat.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-100.png.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.ILGeneration.dll.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\7-Zip\Lang\gu.txt.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.dll.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\DocumentFormat.OpenXml.dll.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Core.dll.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART11.BDR.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Primitives.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe

"C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe"

Network

Country Destination Domain Proto
PL 23.64.12.18:443 www.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 c.pki.goog udp
FR 142.251.37.35:80 c.pki.goog tcp

Files

C:\$Recycle.Bin\S-1-5-21-3951986358-4006919840-1009690842-1000\desktop.ini.tmp

MD5 43e9dd08c048e33c7ae374bfde998bbd
SHA1 93658de1c662ace7eb065aa4d10938cc7cd8fd38
SHA256 e7f521a82eb54e0dd87b4e36feb111769cdd07aed4d588787c62af6d81160417
SHA512 575e28e5a4d2e131e09bf41cf0d13f33e29a26e0be10afe169b0e1e384df7011136e28beee858ac5ee7af15a64e557e860d7524952a3e0aaed426ac81f7bcd28

C:\e871de07eca81c0a47\2010_x86.log.html.tmp

MD5 af54970e22f692637276663d2db243a6
SHA1 bc83c776a20ca07b1721802e6851b8c5db8c1271
SHA256 056347f45f827caf261df3df87c8418cf4d2170a7a8afc35ab5a74208918f865
SHA512 c85a5b66a8292ef64348401383d213c2cebceeab7b399da02cac456d571dba86a2cc2d400f6c108989a54f3daa421afb88f7847df2e2a961e9637a48d97f0269