Overview

overview

9

Static

static

7

384e3547c8...94.exe

windows7-x64

9

384e3547c8...94.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    05/08/2024, 20:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    384e3547c82716457fd0659c18e0076143dd45f24a922da9ec87145ff17e9594.exe

  • Size

    56KB

  • MD5

    8174978ef7e6dcc3e690794242d19257

  • SHA1

    d7f373f8f8c6aa67ae331ef8ac44bcc681547d67

  • SHA256

    384e3547c82716457fd0659c18e0076143dd45f24a922da9ec87145ff17e9594

  • SHA512

    fc980c4605f2ec660d59f5096d4641d2e51bcb98c35323ffdbca8dba7095cf4cda86ba3204308417252b7d050b2b67b5db6688b1b96c5dee6d3758b825d0e974

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2r7:V7Zf/FAxTWtn3

Score
9/10
discoveryransomwareupx

Malware Config

Signatures

  • Renames multiple (3750) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\384e3547c82716457fd0659c18e0076143dd45f24a922da9ec87145ff17e9594.exe
    "C:\Users\Admin\AppData\Local\Temp\384e3547c82716457fd0659c18e0076143dd45f24a922da9ec87145ff17e9594.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1940

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp
          Filesize

          56KB

          MD5

          a83dbb3b2f7d469e2cfc8729a6350e0f

          SHA1

          4a99ecf724d6fb3dcefe774c1d5672144bd7da0f

          SHA256

          cceca58e29b2c837a8d8229e7a187a99eb8f31ebc3e84a254befa94490fb9771

          SHA512

          4bac2b9254ecbe396e9631c63a1d7bcb18eaf5d43ac74933e143893aa45935528097965fc3a711e7a9c15bcd5fbd7d2e8952d267e6f8d0bb79bfdbd22e120784

          Download Submit

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
          Filesize

          65KB

          MD5

          369cebba8aacc32fc75ffbed70aafdd5

          SHA1

          12d837c06b92d1b3d0d4ba0e0538edac0913e718

          SHA256

          872dcf6f19518c6acaed62757f1451f61925c34a4510e8e22d62371d6d8c9600

          SHA512

          b1a22795fd635cf95c50e1864347d6ba34c0454d093faba8c34b5cfbfc691e6199abd84c1e4204ca281605a3571efbc7e012f941b403da573061799b9117208e

          Download Submit

        • memory/1940-0-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

          Download

        • memory/1940-658-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

          Download