Analysis

  • max time kernel
    119s
  • max time network
    99s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/07/2024, 07:16

General

  • Target

    659a0cb06caf03bf06d405aeddb92980N.exe

  • Size

    46KB

  • MD5

    659a0cb06caf03bf06d405aeddb92980

  • SHA1

    e948ee1f1a7c3081aebd329e189160ab11e35327

  • SHA256

    263c25017442f65169d3afe9a0b3dfd492d1a42ce4e223caacb1176ee5cb2bff

  • SHA512

    4593ffaa696c5fa4d209963caacf7c8886be8716b8cc8b9008e88e9ec787b3b888d29b73b7e8cf671bac568f87dcf883f8e331f3bfe2702038f5b0bb85caa403

  • SSDEEP

    768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzW:CTWn1++PJHJXA/OsIZfzc3/Q8zxk

Score
9/10

Malware Config

Signatures

  • Renames multiple (4675) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\659a0cb06caf03bf06d405aeddb92980N.exe
    "C:\Users\Admin\AppData\Local\Temp\659a0cb06caf03bf06d405aeddb92980N.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1176886754-713327781-2233697964-1000\desktop.ini.tmp

    Filesize

    46KB

    MD5

    d5262d4584c021f87d5d65682c58e4d9

    SHA1

    d9b855966dce0718e4997f761d11d22dd081e881

    SHA256

    29000b4845ad239fe052781eebd7c27430f353491e1f701fe7d79dd5b8dbf70e

    SHA512

    3488ae254112c39c44975af475eff4a089d4fcbb29610d35a3469ec7c30d914242903cafe82726e288070a8b42e33426b4cb1a5d453114ce3c6013c52d6e5db8

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    145KB

    MD5

    c5a5f87109c82a623d663ade01b1936d

    SHA1

    87fa8d4bea148e24ae51bf609de83d631aae3e89

    SHA256

    fe53944cca6a497a29214ee487d668b8c732b05be993eb84a6a25e40b0443b97

    SHA512

    fcad050d43a6ba518fdd359e1d5541b3ec18e9e8d999b958abb99a56203b645cb1e9173f9f631a428ae1ddf9ec96ff821a7e4f4ee52e11caf125a5cecc7fe59a

  • memory/1888-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1888-1214-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB