Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    11-06-2024 01:32

General

  • Target

    a65b131acbfe317f270ac014abd90c6ab3425587ad450ab23f41c91c26ffb436.exe

  • Size

    49KB

  • MD5

    20909b6f7ba51725641fc37ced33b937

  • SHA1

    84368e9123247401a9ae2679f34ca78003b3085e

  • SHA256

    a65b131acbfe317f270ac014abd90c6ab3425587ad450ab23f41c91c26ffb436

  • SHA512

    665094cf375e68e078cd8426a29aa3d438c07e9b89f83bbbbb74930785da4b420449e342e581cc691c1adb254d840812a64e98a302dc4911093585541484dbb3

  • SSDEEP

    768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcHY1YL:/7ZQpApze+eJfFpsJOfFpsJk

Score
9/10

Malware Config

Signatures

  • Renames multiple (4048) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a65b131acbfe317f270ac014abd90c6ab3425587ad450ab23f41c91c26ffb436.exe
    "C:\Users\Admin\AppData\Local\Temp\a65b131acbfe317f270ac014abd90c6ab3425587ad450ab23f41c91c26ffb436.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini.tmp

    Filesize

    49KB

    MD5

    80af1a1fdda7a7d099cd02b46600fcf4

    SHA1

    2cda0ae34b93de44a188eaaccfa5d5fd45351af6

    SHA256

    910c208c77740eee41b7cdea125f6066323aba09f4b3a33fcf0ca5864a54cce6

    SHA512

    a1d11a49492a4272f1ff8c116d90b39ade68c39fbe05483b9f5d21d106c92f06b8e294653dce1d94da96cfb4e06204b2b870090ab45ad78a951b733347be3575

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    58KB

    MD5

    09145ac14e43619268d45888abb3afd3

    SHA1

    5a0f13e3968ee7e72357f7771f7d82c62f9137e6

    SHA256

    a4e3cce44ea1c9497ff992201872a381f167bd2180cad206c1a35e34d0a66603

    SHA512

    fc24a8bb8b5b688bf8be2263995ab475003273e4007ac1e4aab8c93a4ab2969b6830e98c6728e9b4626578eb795237f5b57617fce0957e51f61aa52df3fb25d3

  • memory/2324-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2324-662-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB