Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/04/2024, 05:08

General

  • Target

    ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe

  • Size

    58KB

  • MD5

    4fd4b4c230b053f6ee146e1bff0b8faf

  • SHA1

    d3a1f9a4ba40ff2953a3633380088dca27e1dd5c

  • SHA256

    ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148

  • SHA512

    efe7b3c35a8e92b1ad8492df3bda6a376c7584a7be0ccf08c50e6dd099d95701652898e7488f70d4455e9bb0a2e16d38492e056809c75007c2f81f37d792bd59

  • SSDEEP

    768:W7BlpDpARFbhYQkQjjI6OvSox/6Sox/hotyuv:W7ZDpApYbWjIlE77uv

Score
9/10

Malware Config

Signatures

  • Renames multiple (2531) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe
    "C:\Users\Admin\AppData\Local\Temp\ff8f3bbccdedb1faefa8286f03f45039a63f1d98207f19b3c45f81d30f612148.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-513485977-2495024337-1260977654-1000\desktop.ini.tmp

    Filesize

    59KB

    MD5

    a89e0059325e4d683b6c2d0f34224237

    SHA1

    e1c0a0bb2f2c0a37bb358876053e6c44f6cc5a5f

    SHA256

    9f99cfc7fb00855ab24a4d018be1c6c2f96b4ab3b19632120f4c0cdeccd38f37

    SHA512

    52d68cd74e2674ce5cdef80d4b3147f2d349f1acd59827fd2dab22235237852c268c3edfa1b8a2e921f99e0060cc32eaa2faea0489ea99fcd8e4f064adf54e20

  • C:\odt\config.xml.tmp

    Filesize

    60KB

    MD5

    f5216007d420e22c71d645d4cec7640f

    SHA1

    6c82ce65d837ed89e43a872277a40d33b719880b

    SHA256

    5cafee2814eb3562f575dc2be8960556d4b2decb6c44c8019c9f30b52e3c1f50

    SHA512

    cd25f4bf2d9a99cc32b2f71e212474a813ef001a1d139ecd28996fd1ca7cc0a5673c5bda40e6f7496d3b396a68bad7a370648c67848a15ee5c5053b9b62c8221