Analysis

  • max time kernel
    150s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/08/2024, 23:55

General

  • Target

    8c9b355c643c7a175e406a8e4708e3d67416dbcb491ced63ae436eb628bac4f6.exe

  • Size

    68KB

  • MD5

    954d9d976cfe3694d954c9998d96eb0a

  • SHA1

    ef769b39e9415687be7bf906627d8893ad42d5ea

  • SHA256

    8c9b355c643c7a175e406a8e4708e3d67416dbcb491ced63ae436eb628bac4f6

  • SHA512

    f8a69fd5e020bee5d00d07662008381f79e97eebdb273994702e6583978dcf7228b20adadeca300c38a785d32ee5338035590d1a706c56d5c2c9f3be3ce99ad0

  • SSDEEP

    1536:/7ZQpApze+eJfFpsJOfFpsJ9VD6NVD6GUhYTY9:9QWpze+eJfFpsJOfFpsJjub89

Score
9/10

Malware Config

Signatures

  • Renames multiple (5190) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\8c9b355c643c7a175e406a8e4708e3d67416dbcb491ced63ae436eb628bac4f6.exe
    "C:\Users\Admin\AppData\Local\Temp\8c9b355c643c7a175e406a8e4708e3d67416dbcb491ced63ae436eb628bac4f6.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3268

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

    Filesize

    68KB

    MD5

    9ea4d3c0fbef2d8d9373e2c184c47d54

    SHA1

    68c263fd05bb18cbf10f3dcb327d2f698cb7f3cf

    SHA256

    d898420cb715af4272eeb32805c1d4ca6036c73f0ccadcf4a2defd91d9196122

    SHA512

    5484a35a2bebfb94230ec69d1a5407782428eb05d2080834585b0a9707689d68ffb1ea8f699068e443b64a7f115dbc9cc47fec3400db217e70a1e9179518a0f5

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    167KB

    MD5

    93da4a035444a0fe588517301f8c47de

    SHA1

    405334c85ea8f6e739b27a254bfa866387ab8726

    SHA256

    0085b9c9dcfe5f62316f4cbad594513e150294822750ca35fca4918ac7192ec0

    SHA512

    4379315f61212c9715270230dfe26a3709a028c2ceeaa03c0e90dd614ed7d8f34f142d221eb254d65f7b9872d92a001283760c5b436b8b39ebb90af09033b291

  • memory/3268-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3268-1964-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB