Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    22/07/2024, 22:39

General

  • Target

    6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe

  • Size

    72KB

  • MD5

    9d183c314f13d9f9891e9dd3a8d5b752

  • SHA1

    6e8b88a09ebbece0bba4c69e8cfd4b1ca23f7f18

  • SHA256

    6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827

  • SHA512

    2e9ef509535ea22ed5f9d0c18f3c8420f55646eb6d8cc79e271a6206f6cfc2e089cad6076919c31f6420f8803de28d83c4389ce90d1ceece41d2d1534d4a682a

  • SSDEEP

    1536:W7Z+pApfGQ3y3RWvfmRfm9sKsSd5GT6Sr:6+WpDfmRfmh2Tl

Score
9/10

Malware Config

Signatures

  • Renames multiple (3433) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe
    "C:\Users\Admin\AppData\Local\Temp\6c97da7bf8ca5f7944a6e4dcf8d97ae783fd6df2dbdd594856df958e62e3b827.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

    Filesize

    73KB

    MD5

    1ba4194dc5787fe9281a4b6fc412b533

    SHA1

    fb2be1f91d9e80c133c232f5c53de43b5add9367

    SHA256

    2cc17fd0e5681a7a5c6f6f65e8dd97c23413e1e06491ab0b3539484bdff1cd57

    SHA512

    7ac874473eeff09f20cb4fac138e44e8460ca8b53ff92fdc549287f187287110fa0c10288ce10a50fec12f25027744a408f95ac1a0a1f7d774b79d5d31333fff

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    82KB

    MD5

    7eaa46c0481bb1b46c4391a850083301

    SHA1

    ed37c47a0ae5ad7ff2ff783c3ce2dc83aa8f2e3a

    SHA256

    3e2143c2309b17e9104507c00ddbe7a3c393a038ff2fa9e942feb2a9c1f07b5c

    SHA512

    1fe6ca4c1ab536d5d341f625add16c1e36b6baf4a2561d2909c14524c84ec8fd7294df15363dcb2364737cc8126d661c7308b9a1ee93dc835e79278cd92e4b30