Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    25/07/2024, 23:32

General

  • Target

    2dd5947a7243a2f2c9f42328460dd900N.exe

  • Size

    56KB

  • MD5

    2dd5947a7243a2f2c9f42328460dd900

  • SHA1

    0b15dec30543b171f2c9692ef222d7f5420ff08b

  • SHA256

    7a3dbd3ea35a77d2c97b6e0a58311e611500a3a2a587336f986df0c471967795

  • SHA512

    64e182d6252233b539554e7ba146af2cc9d5e4bd4bbae4cb56491033fa0b78112192a8cd6a6524bf7140d173a8202b10e3396169a7602ba4f29ffb3c2de76cbb

  • SSDEEP

    768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcC+3mC+3meD3:/7ZQpApze+eJfFpsJOfFpsJ5D3

Score
9/10

Malware Config

Signatures

  • Renames multiple (2823) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2dd5947a7243a2f2c9f42328460dd900N.exe
    "C:\Users\Admin\AppData\Local\Temp\2dd5947a7243a2f2c9f42328460dd900N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2840

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini.tmp

    Filesize

    56KB

    MD5

    f2864e6911e2ee0c73e3d348a0e6eecf

    SHA1

    d81c5b84d70599582abf8eba4ac7b1709fac9ddc

    SHA256

    8ff429a78cfaf1ca45d22c102f7695b4124615633e6b813bd4ad525d808a8a23

    SHA512

    b9bef90bc47a3085b3441eb6f904661dd129e2f6ec9aae07728b2fb7d04e232a55991e5204cb152d67c53d461ec03a23375d07c91029fce21fc6cf64c26de5db

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    65KB

    MD5

    02e2082c8f7bba0884b583249ad04eea

    SHA1

    a926f87a375ef017161504960e5b3fa33795c204

    SHA256

    91022128969c42f8bf7d17ed4ac94375f718482aafdce4c5b0aad31c0de547a2

    SHA512

    586085a5498f1941579a68ebb06fa36d04623d4083f62b7b19a9e5040207047802bdc86c6edb8aeed20871e41a1c94a92e1399059879b75c165dd4da622adb3e

  • memory/2840-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2840-224-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB