Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-04-2024 06:14

General

  • Target

    e5dc596bd4691282dfd8e1f23e520cdc.exe

  • Size

    66KB

  • MD5

    e5dc596bd4691282dfd8e1f23e520cdc

  • SHA1

    10ed5c0fb45e11b9aabf2e57e5a9233c2b7d97b4

  • SHA256

    68a710da671a2f84de8b75ccdedffd6abf8cbfd7c92ff6ed60ff9fb8c9850d44

  • SHA512

    3fae0c8444a1936a3a924df897a7b0482b51150837360ff2e0876be7080ba44f008504ce33dd908b1447e90c8306a52909fc21ca077dc4143507df55c0ae2df2

  • SSDEEP

    1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhz:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsy

Score
9/10

Malware Config

Signatures

  • Renames multiple (5031) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e5dc596bd4691282dfd8e1f23e520cdc.exe
    "C:\Users\Admin\AppData\Local\Temp\e5dc596bd4691282dfd8e1f23e520cdc.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1132431369-515282257-1998160155-1000\desktop.ini.tmp

    Filesize

    66KB

    MD5

    dd72c2dc88f86a995699600712253c13

    SHA1

    5776bd3c33933591933cc2dc440ee64f7e58f8a0

    SHA256

    dbe84309d640d9f33a9b7295d4acec5c872bdbebcbf8be98194e3bf1be5f7e68

    SHA512

    31dd83109859860d9da9e7548b374c82cef60c57d5a3fac5b63ba6992194c0295a103674f5aad98127257c3454a6499bf3e58668028023745e048a9e8ade64f1

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    165KB

    MD5

    02020bdc50d0c3c048a7f4edf2344117

    SHA1

    d7f1f1b52762eba0723396955f5c2eeb03228ede

    SHA256

    6e3086d1065862014baab4345a7ef50a1fd0899e2e3b866a14d0d41591773997

    SHA512

    9a3f415f650fb24b271077e803945941aa4dcd1232dfe2dc3ccd3c557a564164c14a70633b4fe23fb7a2bbbab6605d95cfca517257c0182a623f70aae5c6fbbf