Overview

overview

9

Static

static

3

08bd364f00...61.exe

windows7-x64

9

08bd364f00...61.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    95s
  • max time network
    99s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/08/2024, 01:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    08bd364f006ecda3b0760d7cbf107a23073529c5e863d6b1521a0612163d0a61.exe

  • Size

    136KB

  • MD5

    a5c0af52fdb53b6e451736bc3287503d

  • SHA1

    63bc7dce786d3c83783749c700bfda7871f91f1c

  • SHA256

    08bd364f006ecda3b0760d7cbf107a23073529c5e863d6b1521a0612163d0a61

  • SHA512

    390fe917b400a472c880c1cefa4ce6f9ed7cda77395365336d6ff4d76827e13eaa1a4ca8a653f73d442cde8c2b51fa17f9c5e566f3f0468abc66604ea21fc723

  • SSDEEP

    3072:x91uZu1iQl0Mep53PKuc7FsTYJ0Fwcl8mcjbuD:x3iMepVPv6mEZfjbU

Score
9/10
discoveryransomwarespywarestealer

Malware Config

Signatures

  • Renames multiple (4424) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Drops file in Drivers directory 16 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\08bd364f006ecda3b0760d7cbf107a23073529c5e863d6b1521a0612163d0a61.exe
    "C:\Users\Admin\AppData\Local\Temp\08bd364f006ecda3b0760d7cbf107a23073529c5e863d6b1521a0612163d0a61.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2056
    • C:\Users\Admin\AppData\Local\Temp\08bd364f006ecda3b0760d7cbf107a23073529c5e863d6b1521a0612163d0a61.exe
      "C:\Users\Admin\AppData\Local\Temp\08bd364f006ecda3b0760d7cbf107a23073529c5e863d6b1521a0612163d0a61.exe" --food
      2⤵
      • Drops file in Drivers directory
      • Drops startup file
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      PID:2656

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\widevinecdmadapter.dll.sola
    Filesize

    234KB

    MD5

    2107894c051aff7e1739cccf850f89c5

    SHA1

    a70d2e2090e31e277389301c7d8de26f7b20b1db

    SHA256

    2492cb79d827fbec0e5626da292868f2bc5748db9a251285b15bc46299aa658b

    SHA512

    8ea98abbc399561fb780a48cb75426eee3fbfc127e628f050b469ed10f33fbeeec81029ca636909642004d23b51ce16073c36708d6de6bacf243b9f3f091a3d7

    Download Submit

  • C:\Program Files\7-Zip\Lang\ms.txt.sola
    Filesize

    5KB

    MD5

    8b2f8ba7d98caab23e010f2c6f7be6d7

    SHA1

    dbcfe11dc8ccf962cec047c03652f85eb4ed860d

    SHA256

    43f0f52f243bbb8da2fc4da63c438a2a45f5fcf9a51cd85a6084564b429c7f9d

    SHA512

    d80652c04583ad46f7557b9410f1e8745b6c882e5e7e2f7447409429c18ff5bd7f09123cc57547acf0e670ee5bffd1b201fa59b7b595b5bd2836deae239ba02d

    Download Submit

  • C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\TestResults.Tests.ps1.sola
    Filesize

    26KB

    MD5

    efd7c88f2bc4748008ef9cf0af10d337

    SHA1

    296347ae27d09b53c056e0c606c89278c0252800

    SHA256

    c5406dc1e3c734d6bf1092e7aa9daef24d1debfbf42531b6ecc89098466ea306

    SHA512

    d143e1d48fe7550a6c4fba364a58028c86fa9480c62160a21eb10ebcdb3a33faf513ea0be2650915c6e39969118c9bffeed46cfbba31c84003d5d265cff85d08

    Download Submit

  • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll.sola
    Filesize

    15KB

    MD5

    c5482a26ce8147f72f89a3d74e7a0843

    SHA1

    8ba5b85fd6d54a13732ae2bfaa6f83b1dc1b831d

    SHA256

    9e5635c0b6243ad97fe8e93b47255ff78944c87615e764010a15819c0ada4ec0

    SHA512

    8bccd2f84d40c3bfaad303776460c0ac0d8bcac101f813c92ddd644b8d0277d14167403c12ed6a1246d441d4fe8291a7f6fcb138061221656222eca6567eff43

    Download Submit

  • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.dll.sola
    Filesize

    18KB

    MD5

    da247d93341f5e15c78ad78ee9d85b03

    SHA1

    92677c442ab0806d55df78bbe3aa41fbb10bd003

    SHA256

    46ff7b257b643b60506cfb30cdb5fb17f5b6e49bbcbd60e618d8338962c05c08

    SHA512

    5d569eef25406aef0aef3145920b4929b15c57f41f22162bb8ba39662372be91614a17fd26c5cbac6b442457e02792a357d161c91c02ab4e8e60cf3c66eb2ab4

    Download Submit

  • C:\Users\Admin\Pictures\Camera Roll\README.txt
    Filesize

    19B

    MD5

    cd0005971dd81c61d5be812f33a2b35e

    SHA1

    01f1ad380bb99d1a80e4fc1800c1b4e5f72e19d9

    SHA256

    e6d506e4376528c4ac030840c4c49d3501b85d1fdd6f367b4c8100c444d528af

    SHA512

    8b6d984ea0c15851f22fd8ea5f8c7925b2d2caacdd81dc5ed301d71feffb08b71dd95d16dee83c2a945e263e3e7b15e6706e2df691c4462f81aa3bae1821ebad

    Download Submit

  • C:\Windows\INF\athw8x.inf.sola
    Filesize

    348KB

    MD5

    967ef771ef8142a3c5e7e02e3aabaf89

    SHA1

    1fc1d4f0f8c498dee48ba0511dec3f54bfef1d97

    SHA256

    404e85c664e45b77ac5a53a3c5c7ae0fe82eef8de1247c2e49f5b0b8a7b35b65

    SHA512

    ad2323ab35459c8a9382aa6dff10249d7dde4d2ae3377feeb572dc54c3144ba71ab4755d4f3628d85c356040e3dc556a6d8d880c6977eddbe2a808a2d6ae75d9

    Download Submit

  • C:\Windows\SysWOW64\Windows.Security.Authentication.Web.Core.dll.sola
    Filesize

    982KB

    MD5

    3b39cb0244057f507eff9d0b63e2300c

    SHA1

    35982842fb7349384ed3297604808207bc9d749b

    SHA256

    d6ae92d8a09533f207210d49b6b4db7955d5860f2231ed6e0956d898461e319f

    SHA512

    3fe43b150bc74abfa7934cc96153da3937952051c725dcba22eee4ed4aaefcfe3e3bcca09d5dafef149b55e447b7a1c32cdd5fae744aba9ad93b1feb24d7788e

    Download Submit