Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    10-06-2024 23:12

General

  • Target

    6d03aab2bf5d6141d1255858f2861ed9c3aee58b9a3ed3a4636504e0de57588b.exe

  • Size

    73KB

  • MD5

    c36a272b352cf89f7f5488f5c9c148e0

  • SHA1

    6348d7b580c279b777165299069f7a15493718f6

  • SHA256

    6d03aab2bf5d6141d1255858f2861ed9c3aee58b9a3ed3a4636504e0de57588b

  • SHA512

    22278b237975ac43f2b32b9bb4295c32d231f8422e0d965c579f2aad7513543938402b8570e29caeadc225c5597e6135026dd03a5221fd46377b09abff4c75d0

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8Q8/8RYH7o:fnyiQSoskRY8

Score
9/10

Malware Config

Signatures

  • Renames multiple (3547) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX dump on OEP (original entry point) 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6d03aab2bf5d6141d1255858f2861ed9c3aee58b9a3ed3a4636504e0de57588b.exe
    "C:\Users\Admin\AppData\Local\Temp\6d03aab2bf5d6141d1255858f2861ed9c3aee58b9a3ed3a4636504e0de57588b.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini.tmp

    Filesize

    74KB

    MD5

    5686bbfefc9ac04d088d73b29ee44b22

    SHA1

    6c098f3dcb4f923d02fd5e8613ecd2c138f1cf68

    SHA256

    a9f5a4e1293c325ddf139f58510094d1bde2b6f159ffebe99c81e3d0dcf7b029

    SHA512

    1a516fbf0652472bf1ca2f1bbb802205fb07a3fa2b9a4d20fd6af32795e63fdc44e602fc74f693e50cb1bdd41baf021fe72ef8e33832f2304c6a580ae8f474ae

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    82KB

    MD5

    25adf03d6a8e8941dda9c0cd37b0d0bf

    SHA1

    0abc4fe65689539910c10de03e2aef6c87215ba6

    SHA256

    20993f06c9bb0d7920815ca8b9a1b28148117802336385f428c43f2cca3277b6

    SHA512

    3eb241be9921784ca66e9c8c4b21c7b6f49ca1f9c061fe26e5d4deaa1ebca591c46308b4d5c2266fb1316ee1b44c0c44c1946262ad3180af598e2993975b48de

  • memory/1756-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1756-656-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB