Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    20/04/2024, 18:05

General

  • Target

    0047bf2bbfdf44d7b42e29dd16b4133aabc16599356d3b956371245d9ad0d694.exe

  • Size

    110KB

  • MD5

    53835e957c21e1a3709f09155e450a27

  • SHA1

    492c47d27d9619e4b8f397907517c5bcd1841845

  • SHA256

    0047bf2bbfdf44d7b42e29dd16b4133aabc16599356d3b956371245d9ad0d694

  • SHA512

    440d17a0f3a706a97b341d6e5f3699b8b2909899f05bb8e21d34e8da6bca464617aa163e5bb681bfd1d73b924bd337d848c0eb136fd3aef79513ee1f5ce9aba5

  • SSDEEP

    3072:6e7WpHIyRF9ESWu0SWuDmhSauvEKxVTLJtxoVz8FUDrYYaCusjdEKxVTLJtxoVza:RqlIyFESWu0SWuGSu

Score
9/10

Malware Config

Signatures

  • Renames multiple (3434) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0047bf2bbfdf44d7b42e29dd16b4133aabc16599356d3b956371245d9ad0d694.exe
    "C:\Users\Admin\AppData\Local\Temp\0047bf2bbfdf44d7b42e29dd16b4133aabc16599356d3b956371245d9ad0d694.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmp

    Filesize

    110KB

    MD5

    2c8a81fd2413fc616ba8f3288ad57834

    SHA1

    725a607f0ce3d83d901c60f13dc9df203ccb7e37

    SHA256

    1622078dfcb5671d1b0d7057900732a05aa7bbc35aa61bb65e964b5925eba4f5

    SHA512

    d74a58ddca75524b12625d9b7d7992f0e3cbd833c6bbce1b158308bdabe00f482ac8c8b8c9c1e010e7d37be9c596440136a12c8605e18da42a7f2d396d80aeba

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    119KB

    MD5

    fd0e6ceacbeef69dadd2907ebfef069e

    SHA1

    025df5e0b0cf0dbf4da3fb0f1bda19eee5b0f476

    SHA256

    0a58ae60014c6f2dacd0904f49b3310860e1abb9d022ceeeea63a17af105ad6d

    SHA512

    7175842a971c34bff3c23ac266b37bb111bf34f87dca2f43c6bc13b5208ce9054693ce01a8cd6889757cf0c310b50d77f385a36b9aebba42b9f19ad9a2b8548f