Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    10-06-2024 23:11

General

  • Target

    6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe

  • Size

    80KB

  • MD5

    368648faf5e1af5dc451aff87084db09

  • SHA1

    3da0d32fca5a44f2dc12084c854b118c6252a4df

  • SHA256

    6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f

  • SHA512

    be9332ee9945cce500bd71dceadfd5ed1e39a5cc48f1ecbcf54bc7110a0afa75421e16a7c523fe59461bca952e80ad493b246d8b9f5f527686136b999b2e8c67

  • SSDEEP

    1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhF:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsw

Score
9/10

Malware Config

Signatures

  • Renames multiple (3532) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe
    "C:\Users\Admin\AppData\Local\Temp\6c640ea027f946747e4d5f9af00ecc3208f5a95a4f9b7d4aea0c14b11e22d19f.exe"
    1⤵
    • Drops file in Program Files directory
    PID:824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini.tmp

    Filesize

    81KB

    MD5

    1f3ed9837c83a3d9c552bbc06f792cb9

    SHA1

    492ae47e7ea980f04a1f805789389afa1ad1f80f

    SHA256

    29f8b236c871ee8f01fdb11c1ad9856007e96ad46d3804fc7c2281964ab06367

    SHA512

    973d3cf62a314a3d45d0a2e7ea7d281c8392dc0d406c403f6bd29b4527a5020f16282a5c7d4cb469ee532e076afacb54f65af01aadda678807417c8a430395c2

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    90KB

    MD5

    2a3d72dfadb9e6484df5ee3b01af69bf

    SHA1

    cda0ed699276a44807f6885e0d08d60da315a9ba

    SHA256

    2afae16f53026e52de49ad29f4c5d8dfe12686865568a2f512a9bb4413314abb

    SHA512

    b997b4300e275a9a79c7919afb9d89994b93736c4fcb59d352810bfc5f786f61934705a03d9696163ee9f4f0f06c575f2989f48d76615a3c91c16e65796d2a27