Analysis

  • max time kernel
    149s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-06-2024 01:36

General

  • Target

    a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe

  • Size

    92KB

  • MD5

    4612de26fb930a321b0ab8c2365445fa

  • SHA1

    b783563db3dd7301b77433928cf542c33463ec4f

  • SHA256

    a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b

  • SHA512

    dfa59052dcd67bd878153ccb0f139cda0f4a1d7bd7d03f522458b17bb11c8e44a08d45b4e479add92bb940a136eb55d8ba5d67049f773089571839eb0a7697d2

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsTq5q9BVI2IBi/:fnyiQSohsUsWU9BK3BW

Score
9/10

Malware Config

Signatures

  • Renames multiple (5025) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX dump on OEP (original entry point) 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe
    "C:\Users\Admin\AppData\Local\Temp\a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe"
    1⤵
    • Drops file in Program Files directory
    PID:4892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1162180587-977231257-2194346871-1000\desktop.ini.tmp

    Filesize

    92KB

    MD5

    d6c7a1e3940290a3505de1991b1d45cd

    SHA1

    07522383b583ebaa1288850fd1adc4c33b2519bf

    SHA256

    7a32894f4c285d8eb4a7fc196507c891258e7335a8c57e3f95b9342d17bd9b0a

    SHA512

    98d7c4e6ff72312a16144935333d19e0a7ebc998e87cc57fa28816574005b5cb07a742cf2359f349da2460043e520110a0418bdbfca09788882eb64fd5f16df3

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    191KB

    MD5

    b27f15757ad6389d29606f6d2705d82e

    SHA1

    1994ddf77c0b078f65a0be1cf1d43d27d0a7607c

    SHA256

    6acb31cad7681429ebe2d334a11ed08d8c0ffacdc613c1a8ffc278c9337a7ca3

    SHA512

    d234f646c51052346b0c15d1d3ade0cc2a641f6d343357c3713831c2b215b03779f1a1e2319f59dadb4f78fc9412cd43c4a402f2488d6de983f0ff205a739e30

  • memory/4892-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/4892-1782-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB