Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/04/2024, 20:41

General

  • Target

    430348f18a19114c9141ea927bf020644510a2f0a41fde722bba5793464bae28.exe

  • Size

    55KB

  • MD5

    9e8affcbe4bb3a40d209962b498cd188

  • SHA1

    044daaddf74a9a1374390ca89d1044dc8b8ea652

  • SHA256

    430348f18a19114c9141ea927bf020644510a2f0a41fde722bba5793464bae28

  • SHA512

    ada47ebfc9f55abecc102293011efa826fa8966c7a7ecb31e917ff2873237e31dc3563607d7165a001f8159b61da62fd3ab9dd7eb248d1ce8fa497d4a22d5388

  • SSDEEP

    768:W7BlpDpARFbhYQkQjjLaManvFNFO/Ms5Ms2Fnj28/8q0N7AVn0N7AVp:W7ZDpApYbWjCDOgj28/8q0NQn0NQp

Score
9/10

Malware Config

Signatures

  • Renames multiple (4879) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\430348f18a19114c9141ea927bf020644510a2f0a41fde722bba5793464bae28.exe
    "C:\Users\Admin\AppData\Local\Temp\430348f18a19114c9141ea927bf020644510a2f0a41fde722bba5793464bae28.exe"
    1⤵
    • Drops file in Program Files directory
    PID:4092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1497073144-2389943819-3385106915-1000\desktop.ini.tmp

    Filesize

    55KB

    MD5

    2546821d0f07f96c86384b57bf59994e

    SHA1

    435c4b6b0dc79039e40b6a116c11a75c56d0b98c

    SHA256

    db36de47590098ece9f80f3bbec220005604a106ed5653a64b81030c5efee493

    SHA512

    f6ffb98bc96c7f4281c1f6e799a4ed34b4844395634bb25bdd26711520fb43ab79eee7f4049ab34a91483c450057a96d91c0d4d5b5e76cfd5a12fdbcb85b94de

  • C:\odt\config.xml.tmp

    Filesize

    56KB

    MD5

    7d5ea582a2bbe678d192209a2144bf63

    SHA1

    d2964df805e835a0838a89727c05d1e4161d573f

    SHA256

    3cafc49b7d09d51cd61d289637f54cc6837e47d2b57d68b90e61605f7c89d89f

    SHA512

    4786df407c55b5375e20a8247d869c6f1b3c5620fd351127d81db84aa7887fea80b13b8e917d964b125a697b6acc0fd62e98d7fef6bf8f7fc850904f1ba14e66