Analysis
-
max time kernel
144s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
23/07/2024, 16:28
General
-
Target
538a76cd2166b3b2b0e88352a2a64f9f13d4bcb2576e0826054ef57c7238bef2.exe
-
Size
818KB
-
MD5
5557b6a82bdd90fcab0e34e1e3c025f5
-
SHA1
586d7469a8f1fcbbc65b4df0f3e26ca49a070e1f
-
SHA256
538a76cd2166b3b2b0e88352a2a64f9f13d4bcb2576e0826054ef57c7238bef2
-
SHA512
7f6764316be7adb165262259fa53bb85c6a844fd9e4b6c85af8a13226f2158e2881ae2fdaa6b3f82f8e9a52f4b7da2af428c388796f5bb7695ed17a47f947143
-
SSDEEP
12288:q9N0xM9tFBB2nFgQPdIjXH2lG+CYCH6tBsS4aKEi7Syc0mrMdCICf8BJJEo8888h:A9TD2nFgQPdQXTJiBsS45DScDCICfM
Score
9/10
Malware Config
Signatures
-
Renames multiple (62) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s) 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\538a76cd2166b3b2b0e88352a2a64f9f13d4bcb2576e0826054ef57c7238bef2.exe"C:\Users\Admin\AppData\Local\Temp\538a76cd2166b3b2b0e88352a2a64f9f13d4bcb2576e0826054ef57c7238bef2.exe"1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
4KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB