Analysis
- max time kernel
150s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20250502-en - resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2025, 17:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe
Resource
win10v2004-20250502-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe
- Size 11.2MB
- Sample250519-waafyacl21
- SHA256 be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04
- MD5 a0d1ee5f17db6ccc97fb635c0375de7f
- SHA1 16509a92b7a988d98d537087b8d0542ad4daf713
- SHA512 1c89ef100012073a2d4eb08740bb1bdb8d06a21149e4f5fd470eaa9fffcfe806e7fe2212644c1f779b5888b571fbfd7e326b9c61fcba7888768d390898924a8c
- SSDEEP 98304:mD4mOf9snfqsuM1TGmX+lIGISb6IvRBtmLuzQMT38t0L7CpHY5OKDlkgE68ac02j:mD/o2GkCrvtH6gmhsOKlkF68Ga4/q
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (221) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\nl.txt.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\7-Zip\Lang\lij.txt.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ink\dicjp.dll.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\7-Zip\Lang\el.txt.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\7-Zip\Lang\ky.txt.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\7-Zip\Lang\sk.txt.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ink\mshwjpnr.dll.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\7-Zip\7z.exe.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\7-Zip\Lang\sa.txt.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\7-Zip\Lang\sq.txt.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwritash.dat.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\7-Zip\Lang\va.txt.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrfralm.dat.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\7-Zip\Lang\bn.txt.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\7-Zip\Lang\is.txt.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\7-Zip\Lang\id.txt.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\7-Zip\7-zip.dll.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\7-Zip\Lang\ca.txt.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\7-Zip\Lang\he.txt.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ink\mshwjpn.dll.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\7-Zip\Lang\ast.txt.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\7-Zip\Lang\pl.txt.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\7-Zip\Lang\si.txt.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\7-Zip\Lang\tr.txt.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\7-Zip\License.txt.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe"C:\Users\Admin\AppData\Local\Temp\be95a1780a322ef5c677e855baf549ba6b02ea5e17246032e068644bb606ba04.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4432
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3299287909-2279959458-198972791-1000\desktop.ini.tmp
- Size 11.2MB
- SHA256 de57a3d35f0cbda70fb7e966e9805533bfba7c40d3ab15550e77b968d27ca596
- MD5 4f824ea591057580d0b1920df63bc2c9
- SHA1 ee132c24fa634052124bc59c13d7d13f97fefa79
- SHA512 af590aea8453e26601eaae88d8ba7a9e4782b5a5aa14536be78a9615886a564dc7ddba246be976f69ddcfd1356be024142223cf5a6e4cb36bdac3ab0fc4d57f1
- SSDEEP 98304:mD4mOf9snfqsuM1TGmX+lIGISb6IvRBtmLuzQMT38t0L7CpHY5OKDlkgE68ac02P:mD/o2GkCrvtH6gmhsOKlkF68Ga4/a
- MD5 SHA1 SHA512 SSDEEP
- Path C:\8e056885788215100b95f8050bba49\2010_x64.log.html.tmp
- Size 11.3MB
- SHA256 fb633bbdcf9035c1cc64b564dcbca4e2cbb7e6db881ab62809ecc5b3ce708446
- MD5 ebae795d06568233fc7477add5f4f149
- SHA1 f0232ed1ab51a9a56bd3535c0b857cb20e5514cc
- SHA512 c55d0b90d2a0a852a1004b6ea8c29158168cb471f26de82962b2e6a14d064037eabac869289ed96c4d826cbb2512ac6371b6bbaf8d24fae27fa554d9138b5d54
- SSDEEP 98304:mD4mOf9snfqsuM1TGmX+lIGISb6IvRBtmLuzQMT38t0L7CpHY5OKDlkgE68ac02h:mD/o2GkCrvtH6gmhsOKlkF68Ga4/Y
- MD5 SHA1 SHA512 SSDEEP