Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-06-2024 23:30

General

  • Target

    749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe

  • Size

    47KB

  • MD5

    259acd55665179cb120ec1fcc52e61ee

  • SHA1

    fa65a71cfaa499a2c64edbd93c85f1d66820de06

  • SHA256

    749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a

  • SHA512

    c8ed0ec4bbaee06f14c27355aaf00b8a84c428cf7e38b166bec2ec085a540820a8a20921b55eda534262b00a2365aaabf7f3d31c184cac59f7aa2f8b4cd514f8

  • SSDEEP

    768:W7BlpNLpARFbhblkYlkuvIYFWcDYcDrf11+Nwf11+NY:W7ZNLpApCZuvIYYoYox

Score
9/10

Malware Config

Signatures

  • Renames multiple (5211) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe
    "C:\Users\Admin\AppData\Local\Temp\749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1162180587-977231257-2194346871-1000\desktop.ini.tmp

    Filesize

    48KB

    MD5

    677335d50a23475caa14839d5250d5a6

    SHA1

    5a5d251f57f55e8cc673919ce7595db866ad2c58

    SHA256

    5fa9e90937f12a0b43cb4abdf041a3511fb4f2320143bb16f4a7e184e514a40a

    SHA512

    c97e5a27b4f0d41010ec99157a2dc205a67acf6dccee75cf6c78d6ea3de8d48b3899179bfc4fc70ab40d2327c770ca2b91067348fa90f71a8d3563cf8f0fd735

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    146KB

    MD5

    c506ff74e6ab5bfd2a8f2c30f8263b92

    SHA1

    3f8ca1179f5f2bd42ae112fc000808dc86332268

    SHA256

    e235bbdb0cab41872ca3ac40bfe8b170b4318f24ff406909d97451835d2da7ff

    SHA512

    dd2987cd238f0364c2cf5f8d686bce0d704e331d2931c19396183f4b33a759891c7041d59880c46c8b68ee2b1cc534200ac6a28b003182a3af17ce5f11244676