Overview

overview

9

Static

static

7

effd76e9c5...0N.exe

windows7-x64

9

effd76e9c5...0N.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    120s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    25/07/2024, 19:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    effd76e9c500e29440f57ccf879f7820N.exe

  • Size

    88KB

  • MD5

    effd76e9c500e29440f57ccf879f7820

  • SHA1

    39dd16595d4bfbdf96f28802bc330afe37c44408

  • SHA256

    821554de9f2716b78b19b251e7308e975dc8693703b66593a661366e16c912ac

  • SHA512

    f28c47952ccef0ab5df00829a1caebb5a9ce4901d5cca856f9d9ad33fdab0fd8533354d5a4f7f3522480e06c2416be6736276667364aa3a0add9a7fce1647f96

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxSL3duXdXp:fnyiQSo5LwtZ

Score
9/10
discoveryransomwareupx

Malware Config

Signatures

  • Renames multiple (2809) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\effd76e9c500e29440f57ccf879f7820N.exe
    "C:\Users\Admin\AppData\Local\Temp\effd76e9c500e29440f57ccf879f7820N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2792

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp
          Filesize

          89KB

          MD5

          6d1bd4abbeba62d18479a67fa6c0db56

          SHA1

          fb37c4bc1b2d29465e10832fb6f081d3bd0f7900

          SHA256

          c9de1432664c62cb2e7645132ddef575aa36dde330cdcc98516bc991126baf0c

          SHA512

          1a451d54552f1130bd67741b73be88203f150fa0302730302cb352dd6a0004f0949243cadbe732d7c75a7188eea88ca1e256cc348dac8c3c21044d24b189c891

          Download Submit

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
          Filesize

          98KB

          MD5

          60d55e3654904510a13a3f57f09d9392

          SHA1

          2688b9ccb91217eb39053345609fdedea4a9b6bd

          SHA256

          628553c10058063a01937583e77b1846067e698b1820e6602d2a20be43079a04

          SHA512

          63c4e06d4a39431029fcb5bda696584524f4e7248794b13654759e121f7a9d015bae693d03836ac69e2f3f7f2bc708d7f162225da5f27c0b59bd50b8a7fe234d

          Download Submit

        • memory/2792-0-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

          Download

        • memory/2792-528-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

          Download