Overview

overview

9

Static

static

7

d413eb50c6...2c.exe

windows7-x64

9

d413eb50c6...2c.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    01/09/2024, 03:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    d413eb50c6e4552ba37d2c66fef526589457b4e9ffb6d2c664bab94c6400ca2c.exe

  • Size

    65KB

  • MD5

    ca93e1528023a112bbc5825a16d1353c

  • SHA1

    eb54f7609f3216378591240ad734b99f4ad367b2

  • SHA256

    d413eb50c6e4552ba37d2c66fef526589457b4e9ffb6d2c664bab94c6400ca2c

  • SHA512

    87ac320cacf7619c9db69fdf6e3b41b94ce1ac8359b921576b82a908e21e93b614897f49e63bcdf0eabcd1913ebf66ff4eebb5af0073f711869134d88ee843a8

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rN:V7Zf/FAxTWJogqwGoDe6jwc

Score
9/10
discoveryransomwareupx

Malware Config

Signatures

  • Renames multiple (3526) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\d413eb50c6e4552ba37d2c66fef526589457b4e9ffb6d2c664bab94c6400ca2c.exe
    "C:\Users\Admin\AppData\Local\Temp\d413eb50c6e4552ba37d2c66fef526589457b4e9ffb6d2c664bab94c6400ca2c.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1820

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini.tmp
          Filesize

          65KB

          MD5

          d4c857ada7331cfbbb2e77ddcbf0b263

          SHA1

          6f469a9d5dbc15c62bf3dc45edb87ce6359652c1

          SHA256

          b2788b974719770e2e7c2c5bb6fed81016978d2f38ddb7cbe8d321ceb84f6de5

          SHA512

          42379b603bef02c931fa1e64156a7dca6a33bf3742275f2e1bea4a2e78bd8a50735c7bbe68043e945a840881cb7f5f13726adcaa3fa7cebd5817b8cb93c6aa4c

          Download Submit

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
          Filesize

          74KB

          MD5

          a24a294dc4a172875b15b8f05eae21d7

          SHA1

          9ace8006cb4fd012fb1d5bdf5ea9e29e5e35db00

          SHA256

          3f9706cc40f154c31a1aae221ed9cfa23b68622deb6cb9c7c8086b7e247e3705

          SHA512

          17cbcd5f11493c3b8ea5733f57af041636582e98d869d84cc34feba17d3585e4b037d6598d2ad1cba85e1373d5da4322138cff3e2d602a28f9d11b6a67f9f43d

          Download Submit

        • memory/1820-0-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

          Download

        • memory/1820-70-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

          Download