Overview

overview

9

Static

static

7

52bbf36f16...0N.exe

windows7-x64

9

52bbf36f16...0N.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    120s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    19/08/2024, 10:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    52bbf36f16a6cac1c54a268de4de3f20N.exe

  • Size

    47KB

  • MD5

    52bbf36f16a6cac1c54a268de4de3f20

  • SHA1

    d3119d597b2f6b8d8f279795150014261d98a737

  • SHA256

    c7d6b3eb4a69cd60b34db812feabde7be5da4100faed540e784a649588539f92

  • SHA512

    3befaedcab6047af41dd3614298af075da04f5334e95e492c40cdc37ffce437e4b4228231a7bbca772585dbaa3723da8e665b28417f57245899c93170ad0af2e

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATBApwpI:V7Zf/FAxTWoJJZENTBAOi

Score
9/10
discoveryransomwareupx

Malware Config

Signatures

  • Renames multiple (3166) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\52bbf36f16a6cac1c54a268de4de3f20N.exe
    "C:\Users\Admin\AppData\Local\Temp\52bbf36f16a6cac1c54a268de4de3f20N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1640

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp
          Filesize

          47KB

          MD5

          22f5a27853f304bc60d447ee2ecfca56

          SHA1

          c6f1e3b90598d3a950354febc2e0e7ae435daf85

          SHA256

          7e6be5d177fba2132a6ca56227086d605eb999730eeab0f456c11ba4ff51dfb3

          SHA512

          3706445e51a1014c6850a85194793a47a0ba6333f543ec1993c952eb82cfd8ee3fe30253a3c9683310b33661252baa09096ade2a1599f2c5455c789e29fc7b14

          Download Submit

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
          Filesize

          56KB

          MD5

          6995b15d7c16839ccafc988e66f9d369

          SHA1

          0d316406a4ad0257c8324f767e2ba79e8fe43bc0

          SHA256

          488119da9cb8f5c3ce7900cb84466fc6403cf0bf4fa3a397725adbbb09d3645c

          SHA512

          7b92419b6d97a98d8bcd36798f15973c48d2b8e658b3963457a16bb097e1db10104362a9ec19cd12de6384fd4d8acf7d6b070a1a2219d22f4a99093924e75dba

          Download Submit

        • memory/1640-0-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

          Download

        • memory/1640-74-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

          Download