Analysis

  • max time kernel
    149s
  • max time network
    51s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-06-2024 23:12

General

  • Target

    6d03aab2bf5d6141d1255858f2861ed9c3aee58b9a3ed3a4636504e0de57588b.exe

  • Size

    73KB

  • MD5

    c36a272b352cf89f7f5488f5c9c148e0

  • SHA1

    6348d7b580c279b777165299069f7a15493718f6

  • SHA256

    6d03aab2bf5d6141d1255858f2861ed9c3aee58b9a3ed3a4636504e0de57588b

  • SHA512

    22278b237975ac43f2b32b9bb4295c32d231f8422e0d965c579f2aad7513543938402b8570e29caeadc225c5597e6135026dd03a5221fd46377b09abff4c75d0

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8Q8/8RYH7o:fnyiQSoskRY8

Score
9/10

Malware Config

Signatures

  • Renames multiple (5194) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX dump on OEP (original entry point) 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6d03aab2bf5d6141d1255858f2861ed9c3aee58b9a3ed3a4636504e0de57588b.exe
    "C:\Users\Admin\AppData\Local\Temp\6d03aab2bf5d6141d1255858f2861ed9c3aee58b9a3ed3a4636504e0de57588b.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp

    Filesize

    74KB

    MD5

    c93f2a363fe2a946744a5350f09440f8

    SHA1

    dd2acd3c7611fb922745d48615f500e035a5ee57

    SHA256

    2ccea6a1b9a4b47ab2ff280a5386be1fe4d11fde98d0a19fa6d39fce1e9fc9b3

    SHA512

    ec375c1848f51f25236dbe0aba36bf8eb20c7c5d3b4131c3a69fb3551cdb5192a74c6a0e2cea297b5ffebcab39704a8913e21d5c55d4c3e2f1094977a777326a

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    172KB

    MD5

    3474e6f3160ba77b8d0c0d6b7470e385

    SHA1

    429c68f43c0ceafbfbabeef581879954ad36e474

    SHA256

    55439c24bd95383e553cd850e879d551912deec6a30371b60d4f936a3eae0861

    SHA512

    a5fa2170cad908fe1d7ac701352330f44deccbc5ff5bc2923ef168d28ca7096f7d3ad3a886607ed19a8df83337453891e84bbf4401d891a362025b0ff8f8e99a

  • memory/2120-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2120-1952-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB