Analysis

  • max time kernel
    120s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    21/08/2024, 19:16

General

  • Target

    04ba92c4ddd031dc5903f0342ef7ea00N.exe

  • Size

    76KB

  • MD5

    04ba92c4ddd031dc5903f0342ef7ea00

  • SHA1

    1f61cf24455f19d210c862578488b802c0cc304d

  • SHA256

    b5b56634537106858b2bced859da3d71afeeb5b9401dea6907c1f76f763c1c04

  • SHA512

    dfc8c39c18bb72ad415290806c7105da2742dc3c0aeb6eeca39dfb0b593f03ed5a85a0b44cf59bf6c72c7f361f214e4040e45654c95d5087c3992a44ad749eb9

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATNy2/mepYXwILQC:V7Zf/FAxTWoJJZENTNyavf73tQqu

Malware Config

Signatures

  • Renames multiple (3159) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\04ba92c4ddd031dc5903f0342ef7ea00N.exe
    "C:\Users\Admin\AppData\Local\Temp\04ba92c4ddd031dc5903f0342ef7ea00N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1956

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini.tmp

    Filesize

    77KB

    MD5

    ecb0598216a2d3b6d4731ced99c64c44

    SHA1

    46634fab46fd205c96b127a25c756383ab69c36b

    SHA256

    d1b7d01aac65ff44c6f04e1da8b252b8284178b67d8e8cd0bf68e62ada054629

    SHA512

    b5b2b0954909223f8809f0e14565d2dc4f55eed4335f1aa3cccd86950efb5f2cb41dd9a1391f73d36c078de59b415deff3db652c852dfff1201c20775f0db446

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    86KB

    MD5

    b70bc385d8af2b59e8ab0cd396eb971e

    SHA1

    cafe52375827cdf8def98e6969fba1432f70c7d4

    SHA256

    66d100398babff3a17ec8a23228856018e0410716bea92c15d89c21087496dc4

    SHA512

    cdd433e62149eeb8f687ea08faf2123293e7dac9f2f1efb92e21d838ad034ff0be320b5b12bca05c21546b29ac4c5b827b233296e00e4e642a9a5a8164507335

  • memory/1956-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1956-74-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB