Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
01-01-2024 15:27
General
-
Target
7e41197b74e2dcc6c0563d4b71a4ad16293909889ce4f1c5ab214bdd59088667.exe
-
Size
153KB
-
MD5
91e890f3e0f1f456486445816797a221
-
SHA1
244741c1514206d953d5d4767fd0c3dd48cfc6d7
-
SHA256
7e41197b74e2dcc6c0563d4b71a4ad16293909889ce4f1c5ab214bdd59088667
-
SHA512
c91287ea947bc43a7c1d54028e487e8df88b4cbce07e0c607fa35d6849189b4f2efb472b1cc80bc2668ff7e9553d28e852a021c8cccd551ecb3d6b1db0e36f5d
-
SSDEEP
768:oS+1pDY5Kp+ByAAAAAAAAAAAAAAAAAAAAzAAAAAAAAAAAAAAAHtAAAAAAAAAAAA3:b+1pc0sB5QV0TGE
Score
9/10
Malware Config
Signatures
-
Renames multiple (199) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e41197b74e2dcc6c0563d4b71a4ad16293909889ce4f1c5ab214bdd59088667.exe"C:\Users\Admin\AppData\Local\Temp\7e41197b74e2dcc6c0563d4b71a4ad16293909889ce4f1c5ab214bdd59088667.exe"1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4548-0-0x0000000000600000-0x000000000062C000-memory.dmpFilesize
176KB
-
memory/4548-1-0x00007FFCF0B20000-0x00007FFCF15E1000-memory.dmpFilesize
10.8MB
-
memory/4548-4-0x000000001B2E0000-0x000000001B2F0000-memory.dmpFilesize
64KB
-
memory/4548-401-0x000000001B2E0000-0x000000001B2F0000-memory.dmpFilesize
64KB
-
memory/4548-402-0x00007FFCF0B20000-0x00007FFCF15E1000-memory.dmpFilesize
10.8MB
-
memory/4548-403-0x000000001B2E0000-0x000000001B2F0000-memory.dmpFilesize
64KB
-
memory/4548-404-0x000000001B2E0000-0x000000001B2F0000-memory.dmpFilesize
64KB