Analysis Overview
SHA256
00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110
Threat Level: Likely malicious
The file 00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110 was found to be: Likely malicious.
Malicious Activity Summary
Renames multiple (5294) files with added filename extension
Drops file in Program Files directory
System Location Discovery: System Language Discovery
Unsigned PE
MITRE ATT&CK
Enterprise Matrix V16
Analysis: static1
Detonation Overview
Reported
2025-05-15 13:33
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2025-05-15 13:33
Reported
2025-05-15 13:36
Platform
win10v2004-20250502-en
Max time kernel
150s
Max time network
143s
Command Line
Signatures
Renames multiple (5294) files with added filename extension
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Primitives.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Drawing.Common.dll.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Google\Chrome\Application\133.0.6943.60\vk_swiftshader_icd.json.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-pl.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Java\jdk-1.8\jre\bin\t2k.dll.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-oob.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-oob.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-oob.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-oob.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.Diagnostics.dll.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Java\jdk-1.8\jre\legal\jdk\bcel.md.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsBase.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Java\jre-1.8\bin\dcpr.dll.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-pl.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ppd.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN097.XML.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\et.pak.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ul-oob.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ppd.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.AddinTelemetry.dll.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8EN.LEX.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT-Rockwell.xml.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-phn.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Primitives.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\UIAutomationClientSideProviders.dll.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.XmlSerializer.dll.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Java\jdk-1.8\include\jawt.h.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Java\jre-1.8\bin\unpack.dll.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected] | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-pl.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINCORE.DLL.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Xaml.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Primitives.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\System.Xaml.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Input.Manipulations.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-localization-l1-2-0.dll.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-phn.xrm-ms.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-80.png.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\OFFSYM.TTF.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN065.XML.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\7-Zip\Lang\ku.txt.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\desktop.ini.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationTypes.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\en-US.pak.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2XML.XSL.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXmlLinq.dll.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\UIAutomationClient.resources.dll.tmp | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe
"C:\Users\Admin\AppData\Local\Temp\00ee5bd2e97680a78a39f21169109e5b26f93e2f6504e5682c6308bef1556110.exe"
Network
| Country | Destination | Domain | Proto |
| DK | 2.19.173.17:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| FR | 142.251.37.35:80 | c.pki.goog | tcp |
Files
C:\$Recycle.Bin\S-1-5-21-343936533-1262634978-1863872812-1000\desktop.ini.tmp
| MD5 | d55d94d782aab5c3f32a0fa7fc247a60 |
| SHA1 | 20e5365f37a953e0ea6a1bafca30386fee1f7f8d |
| SHA256 | 0ca36b84a56479cf7ed504052a225e4509b0fdca8873f6add1fb150275846eef |
| SHA512 | 75b1a162d84baccad642a1f2d1b95c9d9916eab5a8f5455921e72453d9465b6f99a6e5e070c85ef097fcdfc94006d5641833f62b0e0e018c9dd1b0570a094d42 |
C:\f21fae8705b262c53286e8\2010_x86.log.html.tmp
| MD5 | 9023f7bf100e5b44013eec3c53a56afc |
| SHA1 | df7fed39934e581ec3396619e7a72adc9477b24d |
| SHA256 | 845ba42a4a6a93206968631dd5392e367e8007e0a79688afc805d82d6cd3b0db |
| SHA512 | 76ebf35443bd8aeb608e67d01aa2ffd983d3d7550ec32d30674441385c3af3afff74173d003dc3b165e76b251cfc5919fca720c8f18eef4d844282f1fef1faf6 |
memory/4328-797-0x0000000000400000-0x0000000000407000-memory.dmp