Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2025, 07:23
Static task
static1
Behavioral task
behavioral1
Sample
4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe
Resource
win10v2004-20250502-en
General
-
Target
4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe
-
Size
21KB
-
MD5
fca6f4b60b8faf6f4606c8b9dbcd9120
-
SHA1
127aa264c6b6c3f38604dd22970fbdab10d11bf3
-
SHA256
4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760
-
SHA512
c93ec6e1beef89f6d2e4f286c10494e0d5f00ccdfc232033339b552740344fc9eedc197a2117f9eae9607a2f4fb8f804c96f2277e9ca9d2ea71a5437514fb5fc
-
SSDEEP
384:gBt7Br5xjL9AgA71FbhvP/KWLsqmFae+rOAqmFae+rOVQc:s7BlpppARFbhdLz8ae+rOn8ae+rOT
Malware Config
Signatures
-
Renames multiple (5197) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.Primitives.dll.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationTypes.resources.dll.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Primitives.resources.dll.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\UIAutomationProvider.resources.dll.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\et.pak.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Java\jdk-1.8\bin\vcruntime140_1.dll.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\hijrah-config-umalqura.properties.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXC.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-process-l1-1-0.dll.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\OriginLetter.Dotx.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Primitives.dll.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ppd.xrm-ms.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART3.BDR.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\webkit.md.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ppd.xrm-ms.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ppd.xrm-ms.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\mscordaccore_amd64_amd64_8.0.1525.16413.dll.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\System.Xaml.resources.dll.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems32.dll.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ATPVBAEN.XLAM.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceProcess.dll.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationCore.resources.dll.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ppd.xrm-ms.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Design.resources.dll.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Xaml.resources.dll.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationTypes.resources.dll.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\System.Windows.Forms.Primitives.resources.dll.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\7-Zip\7z.exe.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.CodeDom.dll.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ppd.xrm-ms.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-180.png.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-100.png.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\QuizShow.potx.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Controls.Ribbon.resources.dll.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\WindowsAccessBridge-64.dll.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.Common.dll.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-pl.xrm-ms.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL.HXS.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\Microsoft Office\root\Office16\TextConversionModule.dll.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe File created C:\Program Files\7-Zip\Lang\sa.txt.tmp 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe"C:\Users\Admin\AppData\Local\Temp\4126bdb621eed307d86b121fe11f60cd2c38509197a20ec987b54f6f0c6bf760.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4948
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22KB
MD51691204e5a64d173d9985f18cf8eaead
SHA1d00f62444439a8c8a87aa552f8aada6b5271bc41
SHA2569d0070b68f8855388d9b36713b9644b0323fcadd43d2882c5cefda4d07285c06
SHA512f76e5e27aed241f4978518bbfe5456476c9d911a224ae968076ef8c4d4e2a30d2d515c107e9cf05459a7339e711d564bbce13be0ff028e401df78bfc6aa0937a
-
Filesize
107KB
MD546c9cdfeca7fdabc67401a2208ab76cb
SHA1cb16ad8c84d19762b30fad18a0ae445f59806b93
SHA256e2842b0b3733697b85fb2dcf088a13a6636cf9efefde1af5ba1eed73f7e8d15a
SHA5120c323cd34a35e2a453bf5481f53d031639c7db7fc04b8f307a0443510af2caaa3247b8733fa913b8b0e39ae1bd095c22c6a2a339693f2c0d0ee3d56b0db5b345