Overview

overview

9

Static

static

7

72599f993b...31.exe

windows7-x64

9

72599f993b...31.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    11/08/2024, 22:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    72599f993b278d31e8726ccf1e5a4a7199c65eca005f6112b010e1526c45e431.exe

  • Size

    83KB

  • MD5

    425facb3c918ff9a55117f9954100e14

  • SHA1

    105538563237cd7cbb6a0e66908e50f7565a599b

  • SHA256

    72599f993b278d31e8726ccf1e5a4a7199c65eca005f6112b010e1526c45e431

  • SHA512

    1b2f738f524f8462380a2ee1c1a56bb31f0fab8c6a42ae7e632802d4c4fd6481a7c4246b069f13f1ea2a36be29650b181fd73151bd7f63ba2d10032b27b2afe0

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxQiCe5:fnyiQSove5

Score
9/10
discoveryransomwareupx

Malware Config

Signatures

  • Renames multiple (3700) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\72599f993b278d31e8726ccf1e5a4a7199c65eca005f6112b010e1526c45e431.exe
    "C:\Users\Admin\AppData\Local\Temp\72599f993b278d31e8726ccf1e5a4a7199c65eca005f6112b010e1526c45e431.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2788

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini.tmp
    Filesize

    83KB

    MD5

    8e9fc297199008f84c58074f87c8d90b

    SHA1

    0228978aeb152a87f6244d196ab940a7fb95a085

    SHA256

    351dd03e29a91d3c9678d17dc88eb783a8cf555c598c98ec00260c470f4c4ca4

    SHA512

    d4785f886f1e30a529792f11ae8a6e49315daf299507306c293482435500f56c12f98e9bc20458ad95ca86fc674efa69ab889b2768b700987dc82be607603240

    Download Submit

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
    Filesize

    92KB

    MD5

    8898a52a79346a3435c3a2e10cb11c04

    SHA1

    43b8906571e3845f675785a37921c6a67a5e18e7

    SHA256

    d802af186a1f3b1dae14f422fa21535898127fa18430c663bd191d95ea894173

    SHA512

    2fe6445f4399110ff0e82cfde8fcf58868c47725bf0af975e31c62b1e0565d85743c19ef7d447d6804350a191ed675925c586de0f3718905e69008a61c1580e3

    Download Submit

  • memory/2788-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2788-662-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download