Analysis

  • max time kernel
    149s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/05/2024, 04:00

General

  • Target

    c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe

  • Size

    96KB

  • MD5

    a09d9f23d7cf097cad5a88e8b35af246

  • SHA1

    0cb8abbbe2dcea79d915918be3755c1d2581fc77

  • SHA256

    c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499

  • SHA512

    33a286d0442ee1f0c970b71a784de0f371d2755de7fe6b815be7bf5b22c17316f05254d2e95863938ab72c85454b75e4e360962c306e043caff226d36e4570e1

  • SSDEEP

    1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hfO:hfAIuZAIuYSMjoqtMHfhfO

Score
9/10

Malware Config

Signatures

  • Renames multiple (5021) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX dump on OEP (original entry point) 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
    "C:\Users\Admin\AppData\Local\Temp\c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe"
    1⤵
    • Drops file in Program Files directory
    PID:4568

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-3726321484-1950364574-433157660-1000\desktop.ini.tmp

          Filesize

          96KB

          MD5

          252fcdd55716050ba13523d2274f1ad0

          SHA1

          03f3808d0e8cf664712b954212e7bbc50561d2e6

          SHA256

          20b0bb877f67941409842f81b40390fa18304cf9a9c4ab10308c12fccf0ab514

          SHA512

          66b8788c2a63c56206c90b6216cf9bc99330e9a65748d96e20a89856808a00db89ce0a86e71845e3ff3dcbda28a1d23d0e9a631c460f84c11249b89eceea93b1

        • C:\Program Files\7-Zip\7-zip.dll.tmp

          Filesize

          195KB

          MD5

          2d55b110f2615f7477d79e44f98d7c0f

          SHA1

          9d9e5fa33a08f727ebcf0e943f0ecd3aa665f060

          SHA256

          6ae5d4b156b2a491dc6eef567b35ee4f2e9d5f9cce9a20f6c6c52beabd605832

          SHA512

          27ed392480711aac6dbc84b4177c681d7e5fe7f1073dec0a4b6f8d56ac00857e12a9e04fdac74a026108de39ab007dc20390222557057e35ed8fbd5b7f1fd412

        • memory/4568-0-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

        • memory/4568-806-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB