Analysis

  • max time kernel
    120s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    21/08/2024, 03:23

General

  • Target

    d3ffc57b00266bd6eeddda40e821df70N.exe

  • Size

    83KB

  • MD5

    d3ffc57b00266bd6eeddda40e821df70

  • SHA1

    2e510310f87d62ed01b08667b4e4ae9599debba8

  • SHA256

    685faeafe2d6f54130b334fe3a001cd94f34168a0abb730a3af94406f265c353

  • SHA512

    10b10cf35f8b3dfbd1f9f3f73c4cff6e07eac5715dbfe8141f14273b28e2fdebf80c7e7a0bc4702a27954aa395e88e05711db071ac4b0929e99e7fcb58ac7b26

  • SSDEEP

    1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBKgg6RG:69WpQE0zxg1

Score
9/10

Malware Config

Signatures

  • Renames multiple (2929) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\d3ffc57b00266bd6eeddda40e821df70N.exe
    "C:\Users\Admin\AppData\Local\Temp\d3ffc57b00266bd6eeddda40e821df70N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1932

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

    Filesize

    83KB

    MD5

    edb562ba579df9be6de4dd1456b21b47

    SHA1

    68675877599692637b26c570ba4813949d95d1bf

    SHA256

    1c18d22c123f6cf7298b6d3d3de718e9212b705e7d5817b847f93cb7c4b3a55d

    SHA512

    569cd991ca72ec245a25437e85fdf38f216385578043ffc10337579de89a71fa21857074e160390cf4f35cdaa27d13d2896433b2eafc885843872b6f60ec6388

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    92KB

    MD5

    43ebea64726d7c239f9a7ad6f95d7f6b

    SHA1

    81bd7a4ac9eb1ca81603342eacfc44d33250403f

    SHA256

    999b5a285e402fd7627d2a6bdda9ec18629ba92a1f57009d3de51be1c316eb6a

    SHA512

    db3b6833a722bddb3d2dc68191e5bd0ea7a74d7a975903b6f3a81c3c7d73c48131c2b225fe834926ab5d40e7a0515516875289c71f304b5f26f4693a6fcfe9ec