Malware Analysis Report

2025-08-10 20:09

Sample ID 250518-l1kz9aan7v
Target 2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7
SHA256 2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7

Threat Level: Likely malicious

The file 2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7 was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (5257) files with added filename extension

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-05-18 09:59

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-05-18 09:59

Reported

2025-05-18 10:02

Platform

win10v2004-20250502-en

Max time kernel

150s

Max time network

135s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe"

Signatures

Renames multiple (5257) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\CAMERA.WAV.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Common Files\System\ado\msado60.tlb.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\hi.pak.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_sv.properties.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\SAEXT.DLL.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\npt.dll.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - 2010.xml.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-140.png.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\ext\jfxrt.jar.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\7-Zip\License.txt.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Json.dll.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\db2v0801.xsl.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\7-Zip\Lang\gl.txt.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\OFFRHD.DLL.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN027.XML.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\powerpnt.exe.manifest.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_FR.LEX.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\LEELAWDB.TTF.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.Emit.Lightweight.dll.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Serialization.Formatters.dll.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8FR.DLL.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Microsoft Office\root\Templates\1033\EssentialResume.dotx.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-filesystem-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\ta.pak.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\BHOINTL.DLL.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.js.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.POWERPNT.16.1033.hxn.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\OMICAUTINTL.DLL.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationProvider.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Permissions.dll.tmp C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe

"C:\Users\Admin\AppData\Local\Temp\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe"

Network

Country Destination Domain Proto
GB 2.18.27.82:443 www.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.178.3:80 c.pki.goog tcp

Files

C:\$Recycle.Bin\S-1-5-21-3299287909-2279959458-198972791-1000\desktop.ini.tmp

MD5 d0580f3dcaa008552a164b44adc5c2fc
SHA1 500428b383c6a89cf3053cb89210e10af2011865
SHA256 da5b74e921df1ed9759ec866f77d67a88a9dad1f4e0ba6522f5fa90662ad2f86
SHA512 061ed9ab80b038a98ddde986c25ddac3267b3ac70a2b429bc333da4ea3914d722c3f95ccc3fd6af85fd6d2cace8ffaa18bcb3b6dcaed4377120401ebe891268d

C:\8e056885788215100b95f8050bba49\2010_x64.log.html.tmp

MD5 96521be4c8dfc41b706d61e2a0fbeb55
SHA1 001e9c30dfe3d5f730e63ff932168ada7909bac4
SHA256 a4033723ad29492eefa05c3964c59cf34c19513eb91b2496ee8a77f366a90bc9
SHA512 5ae364bbcc7b8cbc90eaa4b604c74b9ebbb3efb1f51ad1f61bba0576f88cae8e07107d6ce0db731fa0d34f8f72fbf3c64c677c8a9a0350c8ebde67e1f104cd37

memory/1408-825-0x0000000000400000-0x0000000000407000-memory.dmp