Analysis

  • max time kernel
    120s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    21/07/2024, 20:46

General

  • Target

    0b5fb9e153f0cb537d28d10c842f5310N.exe

  • Size

    96KB

  • MD5

    0b5fb9e153f0cb537d28d10c842f5310

  • SHA1

    5122d5a47bb0305596b9a6b917a1c5cb4830f17f

  • SHA256

    38cc9a10dbcc39bf2e656b01ab3bc7624d97ca818804b74e5e0399cc52735e99

  • SHA512

    36e9839b86a2078e99a4b04450d559a418f2fbc0e10ada346507cbc5eb04036494d740122fbffe669980fc143fc597ffc2546971565f5daf68204bef56f844b5

  • SSDEEP

    3072:6e7WpP9oVLQthbYY9oVLQthbUvRIWI83B1:RqAZIWIy1

Score
9/10

Malware Config

Signatures

  • Renames multiple (2854) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0b5fb9e153f0cb537d28d10c842f5310N.exe
    "C:\Users\Admin\AppData\Local\Temp\0b5fb9e153f0cb537d28d10c842f5310N.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

    Filesize

    96KB

    MD5

    b0373962451a82e5a51e43fcb506cf30

    SHA1

    ef1cacdafd95846dc174ace0d8c7f2e26ea506b7

    SHA256

    ca0c6261a6107bf52f6fda14f29d7f1c3e14ce4d9aa9fd07d0811afd03111450

    SHA512

    50cfdf1506eaa944a8ce4042d96831d2c9b3040614998974b58224a87fdaac965e70cd5697610959d43181ed1f8f90c465d856dd765616fd7ab6d3b77abd03f8

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    105KB

    MD5

    1e2bcdcab4546146a2917f105ab569c2

    SHA1

    2215be576973b5b3fc9fa8a50464f25bedeb7260

    SHA256

    2bd97cd6b19598445b53a0c278a1ea0d9950357599cf409b32528e9e7fae9147

    SHA512

    3c788ca88cb3778c17c04a8ee17f79c32040f5f838bd6dfb9858227c5f6c5863beeee2bcca4ebb989f5edc843453f8e1b8f07094c0ae5ad39499ff28372743f3