Analysis

  • max time kernel
    150s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/04/2024, 18:05

General

  • Target

    0047bf2bbfdf44d7b42e29dd16b4133aabc16599356d3b956371245d9ad0d694.exe

  • Size

    110KB

  • MD5

    53835e957c21e1a3709f09155e450a27

  • SHA1

    492c47d27d9619e4b8f397907517c5bcd1841845

  • SHA256

    0047bf2bbfdf44d7b42e29dd16b4133aabc16599356d3b956371245d9ad0d694

  • SHA512

    440d17a0f3a706a97b341d6e5f3699b8b2909899f05bb8e21d34e8da6bca464617aa163e5bb681bfd1d73b924bd337d848c0eb136fd3aef79513ee1f5ce9aba5

  • SSDEEP

    3072:6e7WpHIyRF9ESWu0SWuDmhSauvEKxVTLJtxoVz8FUDrYYaCusjdEKxVTLJtxoVza:RqlIyFESWu0SWuGSu

Score
9/10

Malware Config

Signatures

  • Renames multiple (4864) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0047bf2bbfdf44d7b42e29dd16b4133aabc16599356d3b956371245d9ad0d694.exe
    "C:\Users\Admin\AppData\Local\Temp\0047bf2bbfdf44d7b42e29dd16b4133aabc16599356d3b956371245d9ad0d694.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-4084619521-2220719027-1909462854-1000\desktop.ini.tmp

    Filesize

    110KB

    MD5

    558d67c9b29652956cbca6b6ff38f2c0

    SHA1

    3066da1cea6485f8ac5a61a7fc2646700ee5d252

    SHA256

    9081c5199848fc36f277569e46d5e06e497d5618772939243fb77bea17fea52c

    SHA512

    a9ad96f0b13785852f130d8b84d5b4f54597c08d6fae2c6d8e50ddd7bc29a902212a80371ad0c8d7b209d8033e15b493ecf39fe5edd06a74ae6a2d7fcde817e9

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    209KB

    MD5

    adffadd8c321f182b20c829a513ee367

    SHA1

    9083031a03dedacfba3b3a10e584096cdcaa2ec7

    SHA256

    d3f7b056bbfe1be60ff52bca8f83979934c87df3e67325bfe4077a3bf5088f6f

    SHA512

    3225f5edf786215cbd611e6bd7eb2244fd747e42ce433f5c71f106578ff475cc89d398971158d54ad42d8d9a0eaa3c012eb37ccc3f42c6546aa825b5cc8fd3b5