Analysis

  • max time kernel
    149s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    13/08/2024, 23:19

General

  • Target

    ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe

  • Size

    94KB

  • MD5

    bfff451d0911a3ba67db0545eb1deb73

  • SHA1

    242f040a99d2b0b9c665eb89944f7933dca3819f

  • SHA256

    ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a

  • SHA512

    5c028f9569632feadddf8ff6a10d807e82a6be446299bb9e0ceb8bbfd0117566c00c745daf98eb38205bf381793a4c79f3cf921fae8042c8b25d0d5b031de763

  • SSDEEP

    1536:W7Z2sspApGg7bobSM+t58qKcAK+j4nI4VfNgZ11PED4gJQeAAUZa0EzOM6:62ssWpGgrM+t58qKcAK+j4n7ByeFUN

Score
9/10

Malware Config

Signatures

  • Renames multiple (3460) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
    "C:\Users\Admin\AppData\Local\Temp\ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2212

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

    Filesize

    94KB

    MD5

    bbb6037dde8f5881fd30ca77c30e2c7d

    SHA1

    cdaf9bc4c9a089459308481de64c3365ec899b7f

    SHA256

    2e306682b96d6732fdaaef9d58a1c5ee5c8f317dbb8d34ff0f5c69b5310ad8d7

    SHA512

    6bd582321ced3a57c51ca99467cc75695354b83cff6eef8e26fc9143b11ab19e4a90ccce00d9dd05d230df79c0ae1babc9cce9b6a2de58c6751817813a4d11d0

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    103KB

    MD5

    babd3cc1991a84f934930e1fdd71f7b9

    SHA1

    0fd9015aa8338b5faec12c9ae573bea23f80968d

    SHA256

    f76e24b5c78c7bd5eb60dab3fbaa44e262cdb1be7cfecf2880c8824127b29085

    SHA512

    cf731381304ee28376d0ab75c31738475f7ae80a1591b38321312a1ea237eb4f66c90ebdb082dc01712a4e19110dd9e443beba248c4ab97e4cef9d4e22db386a