Analysis

  • max time kernel
    151s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    10-06-2024 23:42

General

  • Target

    79fc6ace5668a85e02e0e569411730054d312595cb2417e659d5073dfcde20ad.exe

  • Size

    86KB

  • MD5

    693d8dc506a7b5d14826d607d4483113

  • SHA1

    2496c57982c1892ea55b265f8b10ac4bfcb59fb6

  • SHA256

    79fc6ace5668a85e02e0e569411730054d312595cb2417e659d5073dfcde20ad

  • SHA512

    9b0ee265aa88eee56b8fd3eeeac405127def4f9d1873140c47c4bf4b8529f21770af029471546f2b1b7ec71de9928b2ed5e42c3810543e5ca9f5f038113fd4ba

  • SSDEEP

    1536:a7ZyqaFAlsr1++PJHJXFAIuZAIuXsJtLJtZ:enaym3AIuZAIuXq

Score
9/10

Malware Config

Signatures

  • Renames multiple (3680) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX dump on OEP (original entry point) 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\79fc6ace5668a85e02e0e569411730054d312595cb2417e659d5073dfcde20ad.exe
    "C:\Users\Admin\AppData\Local\Temp\79fc6ace5668a85e02e0e569411730054d312595cb2417e659d5073dfcde20ad.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini.tmp

    Filesize

    87KB

    MD5

    bb3adcb0999803dcf02d8a1fc4050300

    SHA1

    03d2056b979befc8b78cd2483d8665a7949e3979

    SHA256

    02e254fcf5527ce269543320b616f0aca57b1756d43008186c4fb41602b713d1

    SHA512

    16a006e2df5d81b6a55de0d9840f8403cfb1c0846d6200bb6e956bd3ac09bab6e35dfbeb949d41f2916fdb8d83bc3174f9f68d2a88bb062980d9e58ccea93fd6

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    96KB

    MD5

    f807a75eabc8460a6e4cd35bda30c111

    SHA1

    85e7d02f094e2d7b72d8b6906266df04be688013

    SHA256

    c1ac04fa379f6a5c03fe74dee748622143f795d21267c258f5f50258d99a23f3

    SHA512

    8550cc1b010c81bc2551eb9cedc2f3690f738839eb09448b891b48d543488e8dc373492318a9ea6900047e5da786644528b2435a2eb65639f922ec1aa6be3213

  • memory/1844-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1844-652-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB