Analysis

  • max time kernel
    119s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    07/08/2024, 01:05

General

  • Target

    3b78c8c5396cb6e70c9055462d0a0fb0N.exe

  • Size

    54KB

  • MD5

    3b78c8c5396cb6e70c9055462d0a0fb0

  • SHA1

    05bab07791e411ac69eb549f9a2cf2c4a03e577d

  • SHA256

    441c48505a51e6f182e43455488ab8f20ac7f5ea569e865e87dc3d3aa787ee0e

  • SHA512

    0ea55ac9707fd9e4f3fc541f50b8762e57181c9bec293eb274084a0619556840ded4427d967414c89c0b014b9e23a345d14359e680a1a237d49d2c9753f4e2c4

  • SSDEEP

    768:/7BlpQpARFbhq1KX101ja7c0QXzesa7c0QXze9:/7ZQpApq1U7XQ27XQa

Score
9/10

Malware Config

Signatures

  • Renames multiple (3205) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b78c8c5396cb6e70c9055462d0a0fb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\3b78c8c5396cb6e70c9055462d0a0fb0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2136

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

    Filesize

    54KB

    MD5

    58750553af62ac53ba475b4725da4832

    SHA1

    8f6656cf84a0f6239c9bfaebe072abd2b61e8616

    SHA256

    01c20edf532648d90afbe4896a5d71aa41f2d9bbd9f35fa1928d487175acb9b5

    SHA512

    f28e53426da6cb0f42fd2b18e88367b8be1c38bc518c97cc0814b869d1d2f5805e006c8f72c7440892eea2f3fb57e8dfff114368008604da5b6d8cfdbfc1f57b

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    63KB

    MD5

    a619b62b540e953a9f4c86988f294b3c

    SHA1

    479c4f3bd4074b63c2fb17dfaf9edf08006462b6

    SHA256

    7ed2adc06b5b1869f99e47f8889cb52904569b3b4c4a1a839dfa7c09d4104e3e

    SHA512

    6c7a5025dad9f604895c3694f43752b663ee6b2de9481691926d16beb7b1a4e5a0f9094af934bcd338534499476bcb681b613416d0488d109618a108a6509dbd

  • memory/2136-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2136-652-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB