Overview

overview

9

Static

static

7

abb76afcb4...0N.exe

windows7-x64

9

abb76afcb4...0N.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    120s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    21/08/2024, 23:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    abb76afcb4b5ecbf08dc7e36095c30f0N.exe

  • Size

    40KB

  • MD5

    abb76afcb4b5ecbf08dc7e36095c30f0

  • SHA1

    f1b4c4dd462a1a3b2ce1a551cada4752a5e85c1f

  • SHA256

    fcdbdedfd1564cc608d336f5d243221d66116f481162f0424d6b2a4efa1b3929

  • SHA512

    86c2c24463f38c86dfb38364a862e5f14b0ac5ff1853e4248e506bea27b2966a2d04739cb2f29b1012363228b605a2b4d3ba556b57ced0a68cda12d6a0295fec

  • SSDEEP

    768:kBT37CPKKdJJ1EXBwzEXBwdcMcwBcCBcw/tio/tiBqoPMqoPj:CTW7JJ7TTQoQ/yb

Score
9/10
discoveryransomwareupx

Malware Config

Signatures

  • Renames multiple (3299) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\abb76afcb4b5ecbf08dc7e36095c30f0N.exe
    "C:\Users\Admin\AppData\Local\Temp\abb76afcb4b5ecbf08dc7e36095c30f0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2004

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp
          Filesize

          40KB

          MD5

          e74a3f20cdb771db5db47fefc05b1d2a

          SHA1

          62a7055a3cb099f3d824f5070fcf78711f655419

          SHA256

          a50f0894759d4eb5ba972a5f4a7d1ffd06a021305451eadad09437ace5d6fc91

          SHA512

          70f7fe559ccc30f84533c1b546f41c7341df532e566966311543eb9c35bb0bbaba01de4c1fccde3e54820e97e418485cab8683b02597e28fb4b89f04e09f4d00

          Download Submit

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
          Filesize

          49KB

          MD5

          ecd3112cb3aed03cd8e13155cb02077b

          SHA1

          28c91e1126da44bb9e6a6a506e458e0574f512c2

          SHA256

          ddfce374e61d59eb0c9599094341f15d9089f26a0ec9e67dbb130477a66fcc6b

          SHA512

          73dc5ed0811d9f5dc232ffa2e6f5e359729602df365b31e394f8c669e813e09d770e70394d0ce985710be9130e1e9f5153b94c8e26e43200309bd15fb4522d91

          Download Submit

        • memory/2004-0-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

          Download

        • memory/2004-75-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

          Download