Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
18/05/2025, 09:56
Static task
static1
Behavioral task
behavioral1
Sample
c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe
Resource
win11-20250502-en
General
-
Target
c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe
-
Size
14.7MB
-
MD5
d29172fa28640166d02d335a08dc7702
-
SHA1
2761fe3daed92a49b1ad976b3f3f7eec47eeb462
-
SHA256
c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66
-
SHA512
0cba64c515b2a448516f95ee029c5fc734fbfe74b51e364d5483e95d6901be3c7647fef725b5a7d6e22f79b9e735340cb0684dfaf4e8cdcda72b1fd950bb7dad
-
SSDEEP
393216:hv+pwy3Hq7y3yrdwPEjUC4WaB4g3gMVnbM:h+3SwPEjUb4g3gMVQ
Malware Config
Signatures
-
Renames multiple (223) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\tt.txt.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\7-Zip\Lang\es.txt.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\7-Zip\Lang\sw.txt.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\7-Zip\7zG.exe.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\7-Zip\Lang\ar.txt.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\7-Zip\Lang\hi.txt.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\7-Zip\Uninstall.exe.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\7-Zip\Lang\fr.txt.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\7-Zip\Lang\ko.txt.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrdeusymnn.dat.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\7-Zip\Lang\ast.txt.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\7-Zip\License.txt.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\7-Zip\Lang\be.txt.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ink\dicjp.bin.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\7-Zip\7-zip.dll.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\7-Zip\Lang\tk.txt.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\7-Zip\Lang\fa.txt.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\7-Zip\Lang\fi.txt.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\7-Zip\readme.txt.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\7-Zip\Lang\lv.txt.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe"C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5280
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14.7MB
MD576936e288c0c15c07d40fad7b659aa33
SHA121b13889850862238a05b04c75b768d558efc530
SHA256aa0f7b4a20f701666b9042c9b7f78f33635fb837c7a24a966b863891327945f5
SHA5129fffe9e237ca1316a09fdf9d93ecff6c15f3cf81057987403ce42a462003f64edc5f771c1d7bcbf2ecb4a247d16064498b68a2fb18e0f579a943330980d0f94e
-
Filesize
14.7MB
MD5aec846fa971d15d5c247840edcc27699
SHA18a730aef730767406f9d09a49eb3830211b7064e
SHA25669d67efb54e4b239fa9291569ee92df24deb147e572b50ab24d3d7a8410a7ec2
SHA512cd1a7a52c5c3ab7e421933cfd4e7666d37b2fb96001c957fb7fb690c46a305c138b3a5f9555487313d2af3bc4622445743560decee4c6ce75c9c08a65d469274