Analysis
- max time kernel
150s - max time network
104s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system - submitted
19/05/2025, 09:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe
Resource
win10v2004-20250502-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe
Resource
win11-20250502-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe
- Size 5.8MB
- Sample250519-lp4cfswmt5
- SHA256 d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120
- MD5 420bfe74e8ada51e1859a6f0adbdfdbe
- SHA1 9dba69893151e5a6a852f9151f8578c09af0ecc3
- SHA512 1a2008c3bf18184983ae581d7d150a17ee400a7f5ff6e44983e4e1f3013f15006f07181a68f4df7a95c910ece60f1e683b5f7a60f77ff711f037413e7c609f50
- SSDEEP 49152:rIfSkXXPLetEBZuop98aH6kG52gNNG9okukbP0mVRRT77:sfS+XytEBZuop99H6JsobA/RV
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (519) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.dll.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\7-Zip\History.txt.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\7-Zip\Lang\sw.txt.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-stdio-l1-1-0.dll.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.DispatchProxy.dll.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-0.dll.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\microsoft shared\ink\eu-ES\tipresx.dll.mui.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\desktop.ini.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\7-Zip\Lang\hu.txt.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Mail.dll.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.dll.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XDocument.dll.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\7-Zip\Lang\ka.txt.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\dbgshim.dll.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Native.dll.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\7-Zip\Lang\et.txt.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\7-Zip\Lang\id.txt.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\dotnet\host\fxr\7.0.16\hostfxr.dll.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-2-0.dll.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.dll.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Extensions.dll.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\7-Zip\Lang\hy.txt.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\7-Zip\Lang\pt.txt.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe"C:\Users\Admin\AppData\Local\Temp\d555dd67ab9d37bbe8c72b1bdf3ebd0178c9b3d5daeb7182a7d552a61305b120.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1968
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1178639776-3244803473-3821071008-1000\desktop.ini.tmp
- Size 5.8MB
- SHA256 0be1c70585212fe1b040748ea6d83d80ec2c7044b844cf2524772b3e38d53c18
- MD5 a611ebb13a919cc9c90a54907a18032c
- SHA1 f0e9be698a01ef1ef9e76c061506b35a975abfba
- SHA512 cdd1be336d859c535ad8f4012edd98578196eb09eba01709d5e6bd2bf5e1502c8918eca02cf7519c23cd1b017aeb12f276b1d7656b64ba3fd5c7143f40a4620c
- SSDEEP 49152:rIfSkXXPLetEBZuop98aH6kG52gNNG9okukbP0mVRRT71:sfS+XytEBZuop99H6JsobA/Rv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\f8efe770fb160c3e4e\2010_x86.log.html.tmp
- Size 5.9MB
- SHA256 a0268bb7e49fa4672237bda2ed5f33a0981d1a60c47afac0a4fea3145896b75f
- MD5 7efacdc17bd1c13e172183d99cb86eb7
- SHA1 d7cc7ecb25db21d20d45cfd1c6d7ef99ac9fd5ac
- SHA512 dd32b1e7bb61150ad0fd12ec7278a9aac8d4b2c1f9b7cb1eabad2af5b442c374abe3f79f41266f42ae00dad845286dafca37692a1591f61e08a305c8596c0b9a
- SSDEEP 49152:rIfSkXXPLetEBZuop98aH6kG52gNNG9okukbP0mVRRT7F:sfS+XytEBZuop99H6JsobA/Rn
- MD5 SHA1 SHA512 SSDEEP