Overview

overview

9

Static

static

7

67012c1911...0N.exe

windows7-x64

9

67012c1911...0N.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    120s
  • max time network
    92s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/08/2024, 06:15 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    67012c1911a76df2c8571701725e1a50N.exe

  • Size

    96KB

  • MD5

    67012c1911a76df2c8571701725e1a50

  • SHA1

    6cc539261b2ef3838e6046139fd81d11d5d9a026

  • SHA256

    24e2b748663586f9126e95ff212b0124f327195cca6c01ff2f3a60f000178328

  • SHA512

    d4f6af74daff74ff5c992c6b67dd9e57b6ad7ebd4110849f7b07297d05776f66d517bdd8cecfe81ad5c3136701ddd05785bc8735c8cf70ecf93ea72f913f3845

  • SSDEEP

    3072:fnyiQSoJUBM+PocOQejPdMRAHAASnnD5D5172HyZU3YF40S5DnumSFDnDHaJP1Bc:KiQSo//PxPa

Score
9/10
discoveryransomwareupx

Malware Config

Signatures

  • Renames multiple (4338) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\67012c1911a76df2c8571701725e1a50N.exe
    "C:\Users\Admin\AppData\Local\Temp\67012c1911a76df2c8571701725e1a50N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3916

Network

  • flag-us
    DNS
    71.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    71.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    86.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    147.142.123.92.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    147.142.123.92.in-addr.arpa
    IN PTR
    Response
    147.142.123.92.in-addr.arpa
    IN PTR
    a92-123-142-147deploystaticakamaitechnologiescom
  • flag-us
    DNS
    81.144.22.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    81.144.22.2.in-addr.arpa
    IN PTR
    Response
    81.144.22.2.in-addr.arpa
    IN PTR
    a2-22-144-81deploystaticakamaitechnologiescom
  • flag-us
    DNS
    43.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.229.111.52.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    71.159.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    71.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    86.23.85.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    86.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    147.142.123.92.in-addr.arpa
    dns
    73 B
     139 B
     1
    1

    DNS Request

    147.142.123.92.in-addr.arpa

  • 8.8.8.8:53
    81.144.22.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    81.144.22.2.in-addr.arpa

  • 8.8.8.8:53
    43.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    43.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2927035347-1736702767-189270196-1000\desktop.ini.tmp
    Filesize

    97KB

    MD5

    7da10b84357d7c112c17af5725c88184

    SHA1

    279700790158eb40d290c21ba07aeb3abaaa1649

    SHA256

    06d523eac39104bc015256d8fe8f628d90ee74a9a45cdbb8567889eae3d130ba

    SHA512

    2beb1d05a8634242d31870b0677fa9f43908b3ed03a303a4d6767db227f6e71fd1a36dfa9268f1d68364af0358ffdfd54a9ad103f5f70bc4a1d9a4459eb0cf31

    Download Submit

  • C:\Program Files\7-Zip\7-zip.dll.tmp
    Filesize

    196KB

    MD5

    77628a84c69f02deee44b1b308f82af9

    SHA1

    ea35784a79dc7d8354f19c66eda8165bf9b3cf79

    SHA256

    17340af617096aaa9df1403e7d5e0484234ba357bf1af0ebf4e42fdb2e031988

    SHA512

    9cae4311744a63a30dd469c8a30315fb07a4bb39e803268ef6ba266da4c0c3109383bbca3a78678cc84719964ca775400ca9db4ee2e9d946ec0530c512cf858b

    Download Submit

  • memory/3916-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/3916-1788-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.