Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    19/08/2024, 23:19

General

  • Target

    a8170d9cdef6d8b3649d6dc961974490N.exe

  • Size

    102KB

  • MD5

    a8170d9cdef6d8b3649d6dc961974490

  • SHA1

    3e8e052953285fde5181b99cc17c3f9caec240f0

  • SHA256

    efd87d69f563f557a4669afb106fbae11043432e6725ea4834d0bb049b2cde1b

  • SHA512

    0944b921e92881ce8587e3528260afce921f42bd43e1a75dcf01402086999889700e3c1593a7a5fd721b658b3b20bd6d56cb5f1ea1ea8a80597c39c391e3f62f

  • SSDEEP

    1536:W7ZDpApYbWjIlE77ufL2e+efZwZQ/8S/80PqPIUpCUpiPa:6DWpwE7oL2e+efZwZ08i8X

Score
9/10

Malware Config

Signatures

  • Renames multiple (2925) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a8170d9cdef6d8b3649d6dc961974490N.exe
    "C:\Users\Admin\AppData\Local\Temp\a8170d9cdef6d8b3649d6dc961974490N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1940

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

    Filesize

    103KB

    MD5

    daf75687ae8f494a8341873d8e0a93b1

    SHA1

    108dfb7591992210f111ab53b0cf0b3050d4f7ee

    SHA256

    e66e04e67d783302524d0dd0cdaaff0ba6a35d0eae8e9479ba8fc03df147cbf7

    SHA512

    15a6de9493462fef784069e01715adb83dc4dd64011c9e94fc624ad59089548257066ae392d92522f713895050ac8604d512832345203fe1956141a789426060

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    112KB

    MD5

    6079515a360e08138b850a16f55f75f5

    SHA1

    ebd0022696c0514c862eb215fa05111e836dddb0

    SHA256

    1e5fc3dd1ee5c1f6ab6d4f8d13cc566c8f39f680d914b2c3f2d8ce508545cd85

    SHA512

    04a93abe27939552b072522379af2275451eb0e5befc269019ad31a6bcdb7091ae33de56b548a9f5ca17d0471998b838d85366616de1e2dc7e8e337a5c4df68e