Analysis

  • max time kernel
    149s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    10-06-2024 23:30

General

  • Target

    749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe

  • Size

    47KB

  • MD5

    259acd55665179cb120ec1fcc52e61ee

  • SHA1

    fa65a71cfaa499a2c64edbd93c85f1d66820de06

  • SHA256

    749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a

  • SHA512

    c8ed0ec4bbaee06f14c27355aaf00b8a84c428cf7e38b166bec2ec085a540820a8a20921b55eda534262b00a2365aaabf7f3d31c184cac59f7aa2f8b4cd514f8

  • SSDEEP

    768:W7BlpNLpARFbhblkYlkuvIYFWcDYcDrf11+Nwf11+NY:W7ZNLpApCZuvIYYoYox

Score
9/10

Malware Config

Signatures

  • Renames multiple (3747) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe
    "C:\Users\Admin\AppData\Local\Temp\749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp

    Filesize

    48KB

    MD5

    a877ee9780b6c20eeb01dac5c94c0618

    SHA1

    9d1c38f3ce6aadcf1dcbf6ce0f3d443b183e8459

    SHA256

    803a7838ff367e50c479f6879acbd58426dbab5c80036473e8439596ecdf2c36

    SHA512

    720d42bef97a432db47e85727de63ba2ca55244836d8fec301f01d52bcbb40a06d1c7b0fcef2a7dd034bf172747b17e59310577fdef01cb3de903a4aaf40b4e5

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    57KB

    MD5

    030fa67903e6da2a19c3d84f6d375704

    SHA1

    1adb9900b8fbfc316d0ff73ff30843ef791716bb

    SHA256

    d5508351b123eb8472870524c634a417750dfd31f5a816dc06475943716344b5

    SHA512

    e96e4e47dac9996040fe655a80b7eb82874dd949c342e5b93d08064797f72b0c362e12f67305db2bcf76c274a3a5d528a450924c26672cd57b1f849c839e516b