Analysis
- max time kernel
150s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20250502-en - resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2025, 07:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe
Resource
win10v2004-20250502-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe
- Size 2.5MB
- Sample250518-hypc4sfl7x
- SHA256 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed
- MD5 de241bcb5c5101821c7f94d6dd9098f7
- SHA1 76b00428144967895e0478b428d3674fc0bd264c
- SHA512 4b89eb30913dcafab4d0d66f17927e7434bc9aaa472f459eec0f55e2e50a38c063911b76177b821a56aa9b58bf1289cbc81945c8dd667d31f2a11e0f86bb9966
- SSDEEP 49152:hLoHPM9JQtDw+M4AzO0sE722MumIoZgSj4RQW:poHPM9K9w+M4AzDsE7dMj4RQW
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (1188) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Memory.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClientSideProviders.resources.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemDrawing.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Design.resources.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Permissions.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\7-Zip\Lang\ps.txt.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-2-0.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Primitives.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.Extensions.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.AppContext.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Quic.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\Common Files\System\ado\msader15.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-datetime-l1-1-0.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Private.Uri.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.Extensions.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.Linq.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Linq.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Console.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsFormsIntegration.resources.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ComponentModel.Primitives.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Web.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Input.Manipulations.resources.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.FileVersionInfo.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Design.resources.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Input.Manipulations.resources.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Controls.Ribbon.resources.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Collections.NonGeneric.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Primitives.resources.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Royale.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\7-Zip\Lang\tg.txt.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.DiaSymReader.Native.amd64.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Mail.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\7-Zip\Lang\nl.txt.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsFormsIntegration.resources.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe"C:\Users\Admin\AppData\Local\Temp\30ce967f014c62c397c7669acaa2d900808ad070bd8e0a778ef80dd7822ca6ed.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:652
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2930597513-779029253-718817275-1000\desktop.ini.tmp
- Size 2.5MB
- SHA256 b0bb060a44d663ad316542628f9c839783e0cb3f4eb99fd35b075e75adfab2ae
- MD5 94e3027d33050f9cf37d9052859f3e23
- SHA1 509e94c002996c2ac84f3a89c0d272394af068bb
- SHA512 e252e9c7e1149b0a94792f5badffc6ac3a72a8366445d313e3c989515780f0d45ee59f8e712419faf2f7d2dd7ba35d1484c68138eef869ec6b5907a65b021088
- SSDEEP 49152:hLoHPM9JQtDw+M4AzO0sE722MumIoZgSj4RQM:poHPM9K9w+M4AzDsE7dMj4RQM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\6479eedf55783993fe56765264\2010_x86.log.html.tmp
- Size 2.6MB
- SHA256 345c8f95b539dba93aecc5a484fa14fc4fdf302de77f28a4964bc0de35ccfe95
- MD5 1da7594a3c736d887cdf6093fe4d219d
- SHA1 3295d94341e477b584d18a3252b60b0304a8710c
- SHA512 11b1c8b30031068557c53aa44f08a1cad1c9e36cc3d1b33cdb2c41a12cefe15d2d6e728d80c4e307e491bea07d595df90ce2d3a42862390c838dee4a8f258359
- SSDEEP 49152:hLoHPM9JQtDw+M4AzO0sE722MumIoZgSj4RQ7:poHPM9K9w+M4AzDsE7dMj4RQ7
- MD5 SHA1 SHA512 SSDEEP