Analysis

  • max time kernel
    120s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    26/07/2024, 23:53

General

  • Target

    6db14ae372d63583503ca1c4b843bc80N.exe

  • Size

    39KB

  • MD5

    6db14ae372d63583503ca1c4b843bc80

  • SHA1

    30ad3cb710100d4321ef655d815ddbd34f9bc7a1

  • SHA256

    82cae1141270f65eab38993b94c60ee533bf459211547bf85ca9dc7b76bdef27

  • SHA512

    0c60f21482c8f4e571bc1a104ce2328b262a3dff94f39fb526641c926494cfbbeec5685c092a17f0a006510932daa531cdf926106f947d640077c7f9f6cc00e8

  • SSDEEP

    192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vB7m/FJHo7m/FJHBDPeLS9I/sExeLS9IR:yBs7Br5xjL8AgA71Fbhv3UnUM

Score
9/10

Malware Config

Signatures

  • Renames multiple (1399) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\6db14ae372d63583503ca1c4b843bc80N.exe
    "C:\Users\Admin\AppData\Local\Temp\6db14ae372d63583503ca1c4b843bc80N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1708

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp

    Filesize

    39KB

    MD5

    a6b2bcdf5e1c52928d8bcdc9abf27563

    SHA1

    a1af02870b4503e69c1dcad8676ba159f66c4128

    SHA256

    5c07c1c08e9c90595027fe93fde9a448a55d4d1f395b2bc88ac6d04b5ca60ca7

    SHA512

    2e5494f1661a0f2d80c7d67e5134fc27e34e4541aa52b03f31aa4f3aec3027689b650a10ffd0843a89c4ccaf36d8ba73f1d1522e7d69b18837abf190331ae30a

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    48KB

    MD5

    da1193937ea291186ff76ef821e9678b

    SHA1

    b842dd0ac7d8f10e42143410bd1e5c9df9ea2ecd

    SHA256

    9b977081fe2857a7679e2c075843a4b2ac16fa15f01c2f67aa9d827bdedd886d

    SHA512

    6ec3bbbbac9c9523b10ec8831b7ab744b59f6d3f7507d6d08a3415a2e61cf81c31f756243b07143d29a6f0ce6a715496bce5051dfe58e23e98ae7fe507894f76

  • memory/1708-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1708-126-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB