Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    02/06/2024, 19:53

General

  • Target

    virussign.com_94108bf8801a2e696f0439d188c4d560.exe

  • Size

    49KB

  • MD5

    94108bf8801a2e696f0439d188c4d560

  • SHA1

    7c96882806466870a8dae647a146ef0c1c2e27e4

  • SHA256

    277ad99ee278732db17f4a79156b8870c29b323b16f7a8b846f9513ae597b170

  • SHA512

    b47b2dfedea08cc2bc4d9a5ddfd43d4c01fce07e3e9d27c68022cec6f42a1f38c6d4bac10089474045f0b362c3f3737f3a199da7e689b14ff22924e171cc9094

  • SSDEEP

    768:W7BlpNLpARFbhblkYlkuvIYFKKXPXnPoKXPXnPu:W7ZNLpApCZuvIYy

Score
9/10

Malware Config

Signatures

  • Renames multiple (3690) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\virussign.com_94108bf8801a2e696f0439d188c4d560.exe
    "C:\Users\Admin\AppData\Local\Temp\virussign.com_94108bf8801a2e696f0439d188c4d560.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmp

    Filesize

    49KB

    MD5

    964ce5c698fa1ea62cd84ddb34fb727b

    SHA1

    44e5bdef3d751ed5652756bd53d0778c602f8bf4

    SHA256

    5f78d538ab5e269ad06b1c37a6dec69ebce8dd604f727a3424e27732829eb436

    SHA512

    68fab07eb41341804e4e8a876842fcc1d0b7ee2b58f8dd7b73d7dff43f671d1baff00c3840dce798c08608a858050a219c191fcab556c11c10d1d47d69b6fa77

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    58KB

    MD5

    3ee68860f5b468f62eda22bd5c87c200

    SHA1

    70113c21de4550f2bbb3bc89c131b84a43fe4704

    SHA256

    7af1c2828d430cfde81194c29627a9ed696c53fde0c16266feed601fcc5e85db

    SHA512

    307ae24bd0798589278c7c5cd64a65a4acfe7054d444fb35fbf88a2fd6f4d5cb5619b75a6c17be0c6c8fa4d7d4b9b26742f40483e2d16932554145e305d8f621