Analysis

  • max time kernel
    120s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    02/08/2024, 23:37 UTC

General

  • Target

    1bb4457991dea06e51aae42ccf7bce30N.exe

  • Size

    37KB

  • MD5

    1bb4457991dea06e51aae42ccf7bce30

  • SHA1

    9d501ab4171858a8d38de394137906382a31399b

  • SHA256

    d9f976eef150134408dfc5fb74d40a785bbfd9a64287d7263d07c440f876ca11

  • SHA512

    92c9f191e067fc73d69eb798d3552e95795078ccccd741fa969efaefcbbbe7e6a7b8f18348ec3eb20164c8079b01d2a0f9d8eeae3fb28c4729e6580ac7d9c9c3

  • SSDEEP

    768:W7BlpppARFbhjbhg42LcfpR42Lcfpb2N231F1e:W7ZppApBULcfpHLcfpSo3fs

Score
9/10

Malware Config

Signatures

  • Renames multiple (3367) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\1bb4457991dea06e51aae42ccf7bce30N.exe
    "C:\Users\Admin\AppData\Local\Temp\1bb4457991dea06e51aae42ccf7bce30N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1756

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp

    Filesize

    37KB

    MD5

    e11a5207b8365a899d6005b14772f5f4

    SHA1

    356c0da789c88854480c7ab14348038f0f96754b

    SHA256

    c83163f729f7ebb16ccc21394a4fe99326fb5e628199e90d8027b535b83c0550

    SHA512

    f7d38075e14912fe74a51ded842f2ae1a2c7c1fa9fb3012c7e4f0391064d4c5b474cef4b58a0573a881d0fddaad1658f15561fce8c9c6a052db7f3c96f2a81be

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    46KB

    MD5

    741e2683446f31c162ae8bdc39d9919b

    SHA1

    76b9500f475bac74ae0b9432e8e9a99169a0fe96

    SHA256

    1ff01cee0998f6988fbdc18c4e800e07c204031eb7d4451c53818b3d63744dc0

    SHA512

    ca93cea0fcb033d3d2ce06231a71d7448143df36466e1761ff7bbd8941b873bdc65baa59885cff95dea841876eb3f3903138fdad9d9874414f009c20366d2218

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.