Overview

overview

9

Static

static

7

f3b946a030...4b.exe

windows7-x64

9

f3b946a030...4b.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    14/08/2024, 01:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    f3b946a030786e3288065ad9838ebeec6f5a25b4baefc622b19a04c533e8254b.exe

  • Size

    56KB

  • MD5

    dbac7290759894219c284762d97cefed

  • SHA1

    5251159d8a941c546682a9fecd07839f1e39a022

  • SHA256

    f3b946a030786e3288065ad9838ebeec6f5a25b4baefc622b19a04c533e8254b

  • SHA512

    0c10a51626be1396e0814214db9c692d5da7950f990c65c7ddbade5c17617a0478e9a72d8d2418675a341361a8e0fee2911372c659f1a2b2da8debdca3420ae7

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/tiv:V7Zf/FAxTWoJJ7TTQoQv

Score
9/10
discoveryransomwareupx

Malware Config

Signatures

  • Renames multiple (1100) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\f3b946a030786e3288065ad9838ebeec6f5a25b4baefc622b19a04c533e8254b.exe
    "C:\Users\Admin\AppData\Local\Temp\f3b946a030786e3288065ad9838ebeec6f5a25b4baefc622b19a04c533e8254b.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2928

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp
          Filesize

          56KB

          MD5

          92673e9d4e18c388da3105d7394d15ed

          SHA1

          6e111138d0989434127e1a070e66ff25a533682f

          SHA256

          e11efe90e67adf5811d065f8d16ec6d34bcc27afa0dd6ee36de910a7f6e5e115

          SHA512

          b9f8853ced47d95511ca0573a038aa6bcc664161a8e4328f90cab9f854c2091138c5af3e79a9f2aee2b2b22325b915f521794582b6ad76e64ed5b7a76c3ec6b2

          Download Submit

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
          Filesize

          65KB

          MD5

          045c1a338e86259aca557b57a842149f

          SHA1

          71c8f413c2723a9b12e9af559ac470593ace0c7d

          SHA256

          a0258c771a73876e6d9796f34becbcff9f1047cc55367f36cde459725de67d0b

          SHA512

          6ad7b55994e31d07e555f969ffbabd22c48c4fa2fc8739921dfd7e7354ce9509ff6decdfd128c061771b5ce5cdbdaa289b8357e346c12c9492b344d822c2cbb2

          Download Submit

        • memory/2928-0-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

          Download

        • memory/2928-74-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

          Download