Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
18/05/2025, 11:54
Static task
static1
Behavioral task
behavioral1
Sample
849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe
Resource
win11-20250502-en
General
-
Target
849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe
-
Size
17KB
-
MD5
037aa02e443a62f5c5f084ebe33db79a
-
SHA1
c0c1411baa5212931f514fdcf257caa4775b6474
-
SHA256
849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50
-
SHA512
217336f94abb6e6ef2b3f4907b743aafbe3d65816066cad0f49aa66299c7b536433b34e6b011df0ee767e7bbb5755765d597ce73c9fb53a0f53f57e68462c7ad
-
SSDEEP
384:hAg+5OCZ4W6/KWLsqmFae+rOAqmFae+rOAL2LK:uZ4FLz8ae+rOn8ae+rOM
Malware Config
Signatures
-
Renames multiple (5244) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\ielowutil.exe.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Corbel.xml.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Configuration.SString.dll.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Java\jre-1.8\lib\ext\dnsns.jar.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\PRIVATE_ODBC32.dll.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHSAPIFE.DLL.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-core-localization-l1-2-0.dll.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.DataAnnotations.dll.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Design.resources.dll.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ppd.xrm-ms.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-pl.xrm-ms.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\EXPLODE.WAV.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Json.dll.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.OpenSsl.dll.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.Registry.AccessControl.dll.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ppd.xrm-ms.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BOOKOSB.TTF.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Common Files\System\ado\msado20.tlb.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART12.BDR.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\EEINTL.DLL.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.DiaSymReader.Native.amd64.dll.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrgc.dll.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationTypes.resources.dll.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected] 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ppd.xrm-ms.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.Vectors.dll.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\System.Windows.Forms.Design.resources.dll.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Reflection.eftx.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-pl.xrm-ms.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.resources.dll.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\t2k.dll.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-oob.xrm-ms.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ppd.xrm-ms.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ppd.xrm-ms.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-pl.xrm-ms.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Xaml.resources.dll.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-localization-l1-2-0.dll.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l2-1-0.dll.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-180.png.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clrjit.dll.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ReachFramework.resources.dll.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-phn.xrm-ms.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ul-oob.xrm-ms.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ul-oob.xrm-ms.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\Office16\GKWord.dll.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile.png.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNoteFilter.dll.tmp 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe"C:\Users\Admin\AppData\Local\Temp\849f71ce804616187c30f66bc1a37df7a2f66e0ab1c24eec3b9d16b40bb17d50.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3076
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD5938e619a486bca8a0fc417401c83d3c0
SHA145ad42c126765b1b60552b92ebfcb2154bf39661
SHA256cc8f68026a275c6e96e18f563e8485e0aedc039f4d618799f7e8153931e81ddd
SHA51248ac4f4a06895eae65e14f157330c3d79dbf3e867e7e1a2d8a86a4d3463a2fc184c3035dfd606506f0573132f142ddabcb6993d0a7fc114c1c7fd0d9ce1945a4
-
Filesize
102KB
MD57869b31629de9027ceb24a22ad93cc89
SHA175da97c249ead436fb586752f0060334e5ca01b9
SHA256f1de0e6322382dedbb69722ad96dacee8a3945d6fb059b94bffe9c9d12b86e93
SHA512b617074528972638dafdf54368f7d983d8c0a5fc2d619cfa3ee88ab5b5675feadc57c31284901d02de1fbcddd74e71c890af162712ead08e1395c19a021a6606