Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    08/04/2024, 20:41

General

  • Target

    430348f18a19114c9141ea927bf020644510a2f0a41fde722bba5793464bae28.exe

  • Size

    55KB

  • MD5

    9e8affcbe4bb3a40d209962b498cd188

  • SHA1

    044daaddf74a9a1374390ca89d1044dc8b8ea652

  • SHA256

    430348f18a19114c9141ea927bf020644510a2f0a41fde722bba5793464bae28

  • SHA512

    ada47ebfc9f55abecc102293011efa826fa8966c7a7ecb31e917ff2873237e31dc3563607d7165a001f8159b61da62fd3ab9dd7eb248d1ce8fa497d4a22d5388

  • SSDEEP

    768:W7BlpDpARFbhYQkQjjLaManvFNFO/Ms5Ms2Fnj28/8q0N7AVn0N7AVp:W7ZDpApYbWjCDOgj28/8q0NQn0NQp

Score
9/10

Malware Config

Signatures

  • Renames multiple (3656) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\430348f18a19114c9141ea927bf020644510a2f0a41fde722bba5793464bae28.exe
    "C:\Users\Admin\AppData\Local\Temp\430348f18a19114c9141ea927bf020644510a2f0a41fde722bba5793464bae28.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini.tmp

    Filesize

    55KB

    MD5

    2e04cb5681a930b7acee727fe9677ff8

    SHA1

    0f9c7ebbe43ed07bac398203c9f5429756e9239a

    SHA256

    2b2a431f3b4a2d9765240ba07daa0cd005ab642725613d98ba0e2cf5d8112265

    SHA512

    d77309bc317c5c6c37c60a80287993d1c5e840eda91f8f0c7c0d47c9172855961da407789ee266afc428c4fc2f408c205a61abfc6fe3f8681ab49d20c8736d21

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    64KB

    MD5

    de407590a0443c8c3f282c9744a3419d

    SHA1

    7a38bc56eb181911d5a4b4b1d696a4a3c99179e3

    SHA256

    85d7d211e3ca241c51329827fb625e6635acbb64166d75777d6eb971dadabc42

    SHA512

    3ed642f63da849ea8d921896941f1b5f5a8dbd3f63cb6a1d7bb7dce5f6e8690794a5ef1c7c834f41058277f6895eb7c6539d9e571d3705b6eef342d448578cab