Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    06/07/2024, 18:15

General

  • Target

    10e330a219d8bcd72de91f2c204652d0N.exe

  • Size

    32KB

  • MD5

    10e330a219d8bcd72de91f2c204652d0

  • SHA1

    fc413935fbc2b0f915fbbc76efecbc61c4b29ef0

  • SHA256

    62b99a534b5d2534b71d302ca8ff74121346b9ccc0bb060a1cf8f3f52332824b

  • SHA512

    642815119da1fa521d61c9fe629c8d54e09e84849d6113cad296e31b6a5abdc1bf9d858855bebcb9a1d17a146f4c5c13b7f535ee2b7d5bb30c325c169c5533ae

  • SSDEEP

    768:kBT37CPKKdJJ1EXBwzEXBwdcMc827SKNx27SKNvzcF/MF/h26:CTW7JJ7TG2p26

Score
9/10

Malware Config

Signatures

  • Renames multiple (3993) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\10e330a219d8bcd72de91f2c204652d0N.exe
    "C:\Users\Admin\AppData\Local\Temp\10e330a219d8bcd72de91f2c204652d0N.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

    Filesize

    33KB

    MD5

    0eaaec3c1df6fbb2b1afd8a452a75e56

    SHA1

    b3da126099e6bdeccd2d7169db5f26e31db29875

    SHA256

    c6a4c51ccaa08ae47eaf52af6440ff400c22b6f09124210ac70b00f9783ab79d

    SHA512

    b436416b61c3b3169e7feb6acbd101c1c933e49d9bfe88f80e8cd3ed9963633dc720eb626e6904adc414f42dcfe3869b0b3d025b748cc652718ba8eeaff338d3

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    42KB

    MD5

    a3df67e6cb111cf966bc37d3b350131c

    SHA1

    17caaef38f05cf4c49dfb809d4b64ac13f5f8f21

    SHA256

    7535637b51f587e0aeea9162e46febc44edb11b3ec2743122aed7c34c60751fd

    SHA512

    5a1e0b82bc18b87bc7139efc18a9d79d26d1451e9c3fcecc879144b42aa6070676d4a35e3cc4865fea5ed29df4ce75052b89acf58304829a75d1965a47e3cd51

  • memory/2152-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2152-86-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB