Analysis
- max time kernel
51s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
15/06/2024, 07:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
A25ES6.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
300 seconds
Behavioral task
behavioral2
Sample
A25ES6.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
300 seconds
General
- Target A25ES6.exe
- Size 6KB
- Sample240615-hwaryavgrp
- SHA256 ae9b61783605d32016c855396faa6dee4034de8bd1ea084ae4e3d9d9114b2580
- MD5 e85ffd5a0c28d206d8103cc764764492
- SHA1 1f7a101972f93615e04830a1a4bfb8e1214585c1
- SHA512 1ab44b2570b4e8257ff284d334541c3117b6253bfdd5ac88b785f7e57f489cab5633db99c54e2a83d036f1f792e8998b2206d8a61320d74a97d6739940c9515a
- SSDEEP 96:SxW1xSNRXrDwHaYUeb7eP8q8acfna4sjQfNVj72+/xBlzNt:ykYjHp3RP8q8HfRsjQVVv20p
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (150) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\desktop.ini A25ES6.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\mr.txt A25ES6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll A25ES6.exe File created C:\Program Files\SetSave.tmp.encrypted A25ES6.exe File opened for modification C:\Program Files\7-Zip\License.txt A25ES6.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt A25ES6.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt A25ES6.exe File created C:\Program Files\7-Zip\Lang\lv.txt.encrypted A25ES6.exe File opened for modification C:\Program Files\7-Zip\Lang\tg.txt A25ES6.exe File created C:\Program Files\7-Zip\Lang\tr.txt.encrypted A25ES6.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt A25ES6.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt A25ES6.exe File created C:\Program Files\7-Zip\Lang\fi.txt.encrypted A25ES6.exe File opened for modification C:\Program Files\7-Zip\Lang\tk.txt A25ES6.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx A25ES6.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt A25ES6.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt A25ES6.exe File opened for modification C:\Program Files\7-Zip\Lang\nn.txt A25ES6.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt A25ES6.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt A25ES6.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt A25ES6.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt A25ES6.exe File created C:\Program Files\7-Zip\Lang\mk.txt.encrypted A25ES6.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt A25ES6.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.encrypted A25ES6.exe File created C:\Program Files\7-Zip\Lang\ja.txt.encrypted A25ES6.exe File created C:\Program Files\7-Zip\Lang\ko.txt.encrypted A25ES6.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt A25ES6.exe File created C:\Program Files\ExportMove.mpeg.encrypted A25ES6.exe File created C:\Program Files\7-Zip\Lang\eo.txt.encrypted A25ES6.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt A25ES6.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt A25ES6.exe File opened for modification C:\Program Files\7-Zip\Lang\sw.txt A25ES6.exe File created C:\Program Files\7-Zip\Lang\uk.txt.encrypted A25ES6.exe File created C:\Program Files\7-Zip\7z.dll.encrypted A25ES6.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt A25ES6.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt A25ES6.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt A25ES6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll A25ES6.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.encrypted A25ES6.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.encrypted A25ES6.exe File opened for modification C:\Program Files\OpenSkip.htm A25ES6.exe File created C:\Program Files\7-Zip\History.txt.encrypted A25ES6.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt A25ES6.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt A25ES6.exe File created C:\Program Files\7-Zip\Lang\nl.txt.encrypted A25ES6.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt A25ES6.exe File created C:\Program Files\7-Zip\Lang\hi.txt.encrypted A25ES6.exe File created C:\Program Files\7-Zip\Lang\sw.txt.encrypted A25ES6.exe File created C:\Program Files\NewRename.html.encrypted A25ES6.exe File opened for modification C:\Program Files\TraceUndo.001 A25ES6.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt A25ES6.exe File opened for modification C:\Program Files\AddReceive.rar A25ES6.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt A25ES6.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.encrypted A25ES6.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt A25ES6.exe File created C:\Program Files\7-Zip\Lang\bn.txt.encrypted A25ES6.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt A25ES6.exe File created C:\Program Files\7-Zip\Lang\ta.txt.encrypted A25ES6.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.encrypted A25ES6.exe File opened for modification C:\Program Files\ExportComplete.zip A25ES6.exe File created C:\Program Files\7-Zip\Lang\ms.txt.encrypted A25ES6.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt A25ES6.exe File created C:\Program Files\7-Zip\Lang\uz-cyrl.txt.encrypted A25ES6.exe File opened for modification C:\Program Files\BlockGroup.exe A25ES6.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1708 4808 WerFault.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\A25ES6.exe"C:\Users\Admin\AppData\Local\Temp\A25ES6.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:4808 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 10122⤵
- Program crash
PID:1708
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 4808 -ip 48081⤵PID:4324