Analysis

  • max time kernel
    150s
  • max time network
    51s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/06/2024, 00:49

General

  • Target

    a3efcf19bb4dfc9dc444c395cc25e9d67083fd0ba05d06973a59b4638bb023fd.exe

  • Size

    99KB

  • MD5

    0805c2f9e77dcbdbc3867ee15bcfe257

  • SHA1

    dafdb3dbdb75d3c2b141bb29be1263e05ac4765e

  • SHA256

    a3efcf19bb4dfc9dc444c395cc25e9d67083fd0ba05d06973a59b4638bb023fd

  • SHA512

    95bda36aef9e2813ffb87ac3c932d4f6fb15af971546fbfc1240bfbf230327b20b4f95e6cd1605df53e6cbea89f479bcf2b4038e1ff5e2ac7816a27b46f5d874

  • SSDEEP

    3072:9QWpze+eO888888888888888888888888888888888888888888888888888888X:Lpe+ekeq1l

Score
9/10

Malware Config

Signatures

  • Renames multiple (5069) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a3efcf19bb4dfc9dc444c395cc25e9d67083fd0ba05d06973a59b4638bb023fd.exe
    "C:\Users\Admin\AppData\Local\Temp\a3efcf19bb4dfc9dc444c395cc25e9d67083fd0ba05d06973a59b4638bb023fd.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2532

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp

          Filesize

          99KB

          MD5

          f94421526b71016392aa9689aecbacb9

          SHA1

          09316aea697601188fcc564950d3212819653833

          SHA256

          f95f5b5bf1856d319b6125281220b4d9a0c1033ce5a964f32ced82368e0f38f5

          SHA512

          561ef7888fb152bf977f9629e29e3acc6f70931255148ee3937b7dcdce1d6efbc4cb34bdd00a7af3e918f5a9082c0fed8369135fc9818cf9add6c175eda9efa4

        • C:\Program Files\7-Zip\7-zip.dll.tmp

          Filesize

          198KB

          MD5

          3600cb84df1896815215dc5ac5c2f455

          SHA1

          05c023747897ed7b061bd08cf4c873c0884d74ff

          SHA256

          31813a5a85396da801c34df1924efe00bf90372972c49223364ddd323d24d62a

          SHA512

          c074207157b0ecd4836b23c83e008f19b1bac412f056ca449126ba84389b39233d6fd45c727b11e5f144d32a0fd6269aca759fe330f7e41304628f8911c46528

        • memory/2532-0-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB