Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-04-2024 01:53

General

  • Target

    add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe

  • Size

    94KB

  • MD5

    edeb313b58c9cd4a8fa161e62bc28ade

  • SHA1

    8ff9fbb0aa467ad64594a85bf1221a3ec162a721

  • SHA256

    add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39

  • SHA512

    5eee5b6b149bf8319b72e2a34647a385a528429a54a29ce822886f006b7b5b6858da3695352040da43e8b954c802f8d1a7d20fdbd17138daf7148be06431f7e0

  • SSDEEP

    1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKP761wewz8eg:6rWpcOPxPke+e3fFpsJOfFpsJbgEJRxg

Score
9/10

Malware Config

Signatures

  • Renames multiple (4843) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe
    "C:\Users\Admin\AppData\Local\Temp\add1e9256baceaacffc453442012d9b8d852646013ecc6ef9007676e34868b39.exe"
    1⤵
    • Drops file in Program Files directory
    PID:4636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2288054676-1871194608-3559553667-1000\desktop.ini.tmp
    Filesize

    95KB

    MD5

    9d009c87e1bd013e61734b5c11fd0ee7

    SHA1

    013e6ec220cdbc316e6e8d73c039e595aa389801

    SHA256

    c3779f6c3111fce982830b0ae807e94cce43f20f051c4343a0298d357ac0974b

    SHA512

    488e8aa8ab5c6d671cea27d78e1a86557de9f8ba5056f494f97cbf022b39468267fd58770234e46192b41ced011a77833a4614bdb14ac80d93356626628d560d

  • C:\Program Files\7-Zip\7-zip.dll.tmp
    Filesize

    193KB

    MD5

    dc0ea43b180a4ba1d5a60fcaf9116e97

    SHA1

    24bf83c25e79deb55dedf66130d3a3e93b1a6dd4

    SHA256

    592ad032e701adc79e37449d839cbe424881bcf4ea4fc59f8984a144a22ef271

    SHA512

    f9233ed2888d4b686fa679f70c73195ea85866c01432f5650da2cb3244d9c2728e858d805bc34417230d900f06c4189dfbfaa761a0c0de45a284d09e5c77f25e