Analysis Overview
SHA256
4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4
Threat Level: Likely malicious
The file 4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4 was found to be: Likely malicious.
Malicious Activity Summary
Renames multiple (5200) files with added filename extension
Drops file in Program Files directory
System Location Discovery: System Language Discovery
Unsigned PE
MITRE ATT&CK
Enterprise Matrix V16
Analysis: static1
Detonation Overview
Reported
2025-05-15 07:23
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2025-05-15 07:23
Reported
2025-05-15 07:26
Platform
win10v2004-20250502-en
Max time kernel
149s
Max time network
135s
Command Line
Signatures
Renames multiple (5200) files with added filename extension
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\cs.pak.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ppd.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\SharePointPortalSite.ico.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsFormsIntegration.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Java\jdk-1.8\lib\ir.idl.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ppd.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Core.dll.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Primitives.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ul-oob.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-pl.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\AppvIsvSubsystems64.dll.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\rsod\office32mui.msi.16.en-us.tree.dat.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ppd.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL103.XML.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ppd.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Numerics.dll.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Private.CoreLib.dll.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\WindowsFormsIntegration.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri.xml.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ul-oob.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-180.png.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\WEBSANDBOX.DLL.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\7-Zip\Lang\eu.txt.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationCore.dll.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-pl.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ppd.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.AnalysisServices.AdomdClientUI.dll.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.tree.dat.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\Microsoft.VisualBasic.Forms.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-100.png.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.ILGeneration.dll.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-pl.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\msoev.exe.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\7-Zip\Lang\gu.txt.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.dll.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\System.Windows.Forms.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\DocumentFormat.OpenXml.dll.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Core.dll.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART11.BDR.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Primitives.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-pl.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe
"C:\Users\Admin\AppData\Local\Temp\4432a9d32d4eefaa3ff8335fb2f07d6afcf26fc38ef702a2af194af215457ed4.exe"
Network
| Country | Destination | Domain | Proto |
| PL | 23.64.12.18:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| FR | 142.251.37.35:80 | c.pki.goog | tcp |
Files
C:\$Recycle.Bin\S-1-5-21-3951986358-4006919840-1009690842-1000\desktop.ini.tmp
| MD5 | 43e9dd08c048e33c7ae374bfde998bbd |
| SHA1 | 93658de1c662ace7eb065aa4d10938cc7cd8fd38 |
| SHA256 | e7f521a82eb54e0dd87b4e36feb111769cdd07aed4d588787c62af6d81160417 |
| SHA512 | 575e28e5a4d2e131e09bf41cf0d13f33e29a26e0be10afe169b0e1e384df7011136e28beee858ac5ee7af15a64e557e860d7524952a3e0aaed426ac81f7bcd28 |
C:\e871de07eca81c0a47\2010_x86.log.html.tmp
| MD5 | af54970e22f692637276663d2db243a6 |
| SHA1 | bc83c776a20ca07b1721802e6851b8c5db8c1271 |
| SHA256 | 056347f45f827caf261df3df87c8418cf4d2170a7a8afc35ab5a74208918f865 |
| SHA512 | c85a5b66a8292ef64348401383d213c2cebceeab7b399da02cac456d571dba86a2cc2d400f6c108989a54f3daa421afb88f7847df2e2a961e9637a48d97f0269 |