Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    22/04/2024, 00:45

General

  • Target

    966253978638a41b59dbdc655961f946e31c403fca273da1c872b4a54fdf3bb1.exe

  • Size

    101KB

  • MD5

    30aabe8e0ef920474f5a7549713f9568

  • SHA1

    8d19f9086881af83264669066acc90883ab37d3c

  • SHA256

    966253978638a41b59dbdc655961f946e31c403fca273da1c872b4a54fdf3bb1

  • SHA512

    7507fc9ff971ae9771b8a4affb51c69e7d9fc1bc1d8731933020723be8a02e731fea58f132ed19299ac49d8e6e7aeb8d5e95bdc93f5575b17a52c738a9dba729

  • SSDEEP

    3072:6rWpcOPxPke+e3fFpsJOfFpsJbgE2GEJdwJdB:tFPxPke+eI2G7

Score
9/10

Malware Config

Signatures

  • Renames multiple (3451) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\966253978638a41b59dbdc655961f946e31c403fca273da1c872b4a54fdf3bb1.exe
    "C:\Users\Admin\AppData\Local\Temp\966253978638a41b59dbdc655961f946e31c403fca273da1c872b4a54fdf3bb1.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini.tmp

    Filesize

    101KB

    MD5

    73a547b506edc2dc05220d561933a501

    SHA1

    f83d208c124d0d1f6f103ec82411a64dd95a5bba

    SHA256

    621c52c780f440a4bfa8b658ac181d5b0ee1b6fd74d7667cf7d1f37e5fbaab3d

    SHA512

    99d38cfb975f54575a14ae0b36c9653fe171873dffd3846ca57e5af4b10ce113fe7035de3290a7f21c3ee81a6897ae2335fd159011c9401537a70bbd1f728fb4

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    110KB

    MD5

    fcdbec3b6c58674d85b4652a853c8c17

    SHA1

    85789953948000e5484f2d55cdd41a5a088cc306

    SHA256

    ca0ba763421310cb2c464a981628b4ec1b075d84b6f51a2f24bd944f4db15db5

    SHA512

    f3d8b59b829477083635634ebb31000632c7c5f1752786d23a0a4a08c697f476d633f30e6d08c0405169e7ad985927e5fc098c1aae0fa70b240ae09ca85c188b