Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
19/05/2025, 13:42
Static task
static1
Behavioral task
behavioral1
Sample
205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe
Resource
win10v2004-20250502-en
General
-
Target
205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe
-
Size
22KB
-
MD5
f4f81d5bdc2928fcc6d8dc35e3633377
-
SHA1
58b1f2a5258a918498e8afc7a1f52ac6c7d3d462
-
SHA256
205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668
-
SHA512
fa58f05b5765b0d0aa540f04f2a9bf17e2f6e2c7634540b8a133e9903e4d3756cdef8db7aa72ff7e3a267ade9c42d467488d42f9e221458a9edfae27fa4a9706
-
SSDEEP
384:hAg+5OCZ4W6/KWLsqmFae+rOAqmFae+rO3IYogKO4iJfogKO4iJ7:uZ4FLz8ae+rOn8ae+rO3IYogKO4iJfow
Malware Config
Signatures
-
Renames multiple (5247) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationProvider.resources.dll.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\bci.dll.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightItalic.ttf.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\xerces.md.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\DocumentFormat.OpenXml.dll.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ul-oob.xrm-ms.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.dll.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\UIAutomationClient.resources.dll.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Java\jre-1.8\bin\sunmscapi.dll.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Microsoft Office\root\Client\C2R32.dll.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ppd.xrm-ms.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSPECTRE.DLL.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-environment-l1-1-0.dll.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PG_INDEX.XML.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7FR.LEX.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\DirectWriteForwarder.dll.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-pl.xrm-ms.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Microsoft Office\root\Office16\GKPowerPoint.dll.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Linq.Parallel.dll.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-oob.xrm-ms.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\EUROTOOL.XLAM.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-pl.xrm-ms.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ul-oob.xrm-ms.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\HAMMER.WAV.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\msipc.dll.mui.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-PipelineConfig.xml.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\EssentialReport.dotx.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\TimelessLetter.dotx.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Xaml.resources.dll.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationProvider.resources.dll.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationUI.resources.dll.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Riblet.eftx.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\BOMB.WAV.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCallbacks.h.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_HK.properties.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ppd.xrm-ms.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ul-oob.xrm-ms.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Microsoft Office\root\Office16\Custom.propdesc.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\glib.md.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ppd.xrm-ms.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.XmlSerializers.dll.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\7-Zip\Lang\ka.txt.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\7-Zip\Lang\mr.txt.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.dll.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Collections.Concurrent.dll.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Input.Manipulations.resources.dll.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ppd.xrm-ms.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Extensions.dll.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\UIAutomationClientSideProviders.resources.dll.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-80.png.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe File created C:\Program Files\7-Zip\Lang\en.ttt.tmp 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe"C:\Users\Admin\AppData\Local\Temp\205b03b6ac2f31a24c60eece87eb8d2c014dad106a4c907a47d4b0927b396668.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5104
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22KB
MD5b6faa3800f846767320c17c2a39f4ce9
SHA1d68a7db86b7011e4204bf623caca2e9ddaa6e6f4
SHA2569693780982c267ae0ec47ef0b4283db6d1aa0d51316d01f74ff29e6f0022abe5
SHA512a66977087816ed50185eb3259bfcf8a57168369e44c774c2db05065d3e95d86f2b317a8b9278f56f8a7628e3a49dd0cea070280686cb854475376c8f02e560d4
-
Filesize
103KB
MD5687bcda7022f0ef1559b9873ff56d0b0
SHA1d385d66b158ce59cd02cb68293b005fbc568b761
SHA256f107e7e6757a702911d587ee22aeb8429cb0661f70951da8ab52628d676e4b3a
SHA512c10b1bf68fffd064afd81f285ad1baabaad6a0762ae9def38a23e28f873cc7863c943af8ae679409b100563e6c7210045c7106d3e85cd68e68f7dd4640af5933