Analysis
- max time kernel
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 13:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
211125-ml9whaehcn.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
211125-ml9whaehcn.exe
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target 211125-ml9whaehcn.exe
- Size 297KB
- Sample260604-qzx1msgw3p
- SHA256 ade5780b02f010a91f0684089100035366af865caba9c6beb66a271ccc89f2ae
- MD5 6ad73683b4747a9b8a4139d7d8e59f2a
- SHA1 3c9905a81d3bbd8831324dc02c3a2074a486bf15
- SHA512 3d9b7efb603cf04e08959d65ee078fa2a647fdeb0545ea32a17de28f985a8b4bf11f45644e950d73b4e651abb53ceff4bb7df9b86b03cb852a910675b95aaaa3
- SSDEEP 6144:8CE4vZExsqr4aYWiC+F99UGGjpeoXN6/Tvg8vcJHemY63q1ih:8Sv4IvFkGM/XUfvcJ/Y6qU
- TLSH T19F542900B291D636F9F304B4B7AB2AAB899D5A302359D3D707D36CC919613D3BB30B56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (7508) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\is_it_possible_return_back lost documents.txt 211125-ml9whaehcn.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\cs-cz\ui-strings.js.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-pl.xrm-ms.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\el.pak.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\main.css.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Bus Schedule.pdf.intercobros-9k7syfus 211125-ml9whaehcn.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\is_it_possible_return_back lost documents.txt 211125-ml9whaehcn.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-tw\ui-strings.js.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-pl.xrm-ms.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN109.XML.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\digsig_icons_2x.png.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.runtimeconfig.json.intercobros-9k7syfus 211125-ml9whaehcn.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\css\fonts\is_it_possible_return_back lost documents.txt 211125-ml9whaehcn.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\jpeg_fx.md.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-ae\ui-strings.js.intercobros-9k7syfus 211125-ml9whaehcn.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\hr-hr\is_it_possible_return_back lost documents.txt 211125-ml9whaehcn.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-ae\ui-strings.js.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.intercobros-9k7syfus 211125-ml9whaehcn.exe File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\nl-NL\is_it_possible_return_back lost documents.txt 211125-ml9whaehcn.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nb-no\is_it_possible_return_back lost documents.txt 211125-ml9whaehcn.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hu-hu\ui-strings.js.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\es-es\ui-strings.js.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.LEX.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jfr\default.jfc.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Locales\ta.pak.intercobros-9k7syfus 211125-ml9whaehcn.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\is_it_possible_return_back lost documents.txt 211125-ml9whaehcn.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\is_it_possible_return_back lost documents.txt 211125-ml9whaehcn.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-fr\ui-strings.js.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\[email protected] 211125-ml9whaehcn.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon_hover.png.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\print_poster.png.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ru-ru\ui-strings.js.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sv-se\ui-strings.js.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri.xml.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-140.png.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\plugin.js.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.tree.dat.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\OUTEX2.ECF.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\lv.pak.DATA.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon_2x.png.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt.intercobros-9k7syfus 211125-ml9whaehcn.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\Assets\Icons\is_it_possible_return_back lost documents.txt 211125-ml9whaehcn.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-phn.xrm-ms.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\AdjacencyReport.dotx.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner.png.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\ka.pak.DATA.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\sendforcomments.svg.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-ae\ui-strings.js.intercobros-9k7syfus 211125-ml9whaehcn.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\cs-cz\is_it_possible_return_back lost documents.txt 211125-ml9whaehcn.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-pl.xrm-ms.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-pl.xrm-ms.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUTL.OLB.intercobros-9k7syfus 211125-ml9whaehcn.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\is_it_possible_return_back lost documents.txt 211125-ml9whaehcn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote.gpd.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\gd.pak.DATA.intercobros-9k7syfus 211125-ml9whaehcn.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\move.svg.intercobros-9k7syfus 211125-ml9whaehcn.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\contrast-black\is_it_possible_return_back lost documents.txt 211125-ml9whaehcn.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 211125-ml9whaehcn.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\is_it_possible_return_back lost documents.txt
- Size 1KB
- SHA256 ed3057f2ce34a7b1804130a28f96fea734cf741410aafae5a0130879f2026317
- MD5 052dbff23af9e53e643c3fd277f98c3d
- SHA1 95439c7169c75b22967f295962dfd6b22b0d1b70
- SHA512 bb47eded456f496d73f41e2ba7ef56360dfc2ae30f8932e7410b7902d464be52d2fcf2e8d4077cfa24b66daac8c6952e1b790f34fafff40699d408099545f9f0
- TLSH T13321850FE09D00482FA173E133109951B6ED692C677402A828ABC1BC33E0F73AEB609C
- MD5 SHA1 SHA512 TLSH