Analysis

  • max time kernel
    119s
  • max time network
    118s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/09/2024, 11:05

General

  • Target

    c6cf5996b18290b16a9e46bbbd9e9e90N.exe

  • Size

    43KB

  • MD5

    c6cf5996b18290b16a9e46bbbd9e9e90

  • SHA1

    830655cb59afb7c46bcd3c38fd08af041b94e30b

  • SHA256

    8d946a5896de79041fbc3714bf4011a02c40b480da9f5ba31cb849e31bcfea4e

  • SHA512

    f94aa70c7ff3ae48d2658c927d427638944e012e4e7c6472bd2d17e2ada8a1c643369f500e2c28c9b446f890964751c691fd2d9de37a72f2f0385ec2b079def0

  • SSDEEP

    384:GBt7Br5xjL9A7AgA71Fbhvnqj7jU7ubTAgpbuvx10AaIdKB7ubTAgpbuvx10AaIj:W7BlphA7pARFbhL801VvM801Vvv7cYR

Score
9/10

Malware Config

Signatures

  • Renames multiple (4658) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c6cf5996b18290b16a9e46bbbd9e9e90N.exe
    "C:\Users\Admin\AppData\Local\Temp\c6cf5996b18290b16a9e46bbbd9e9e90N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3744

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

    Filesize

    43KB

    MD5

    c93bb56764543e2a357db9f027afc494

    SHA1

    7d80cbc8721bcc880b857c5f266e8184b68f7ecd

    SHA256

    39e947dbc77f762d13a62f8bc293549edbfabf316092368764257671358f67e2

    SHA512

    7fe82718ae7ad8fc02e97d1bc1f10a039bbe2fb41e503ecb53d539a4fedf4932fcad4dd16978765deddc56b9b52a61733e6282ceafd743ebc86db1363aa068cb

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    142KB

    MD5

    a599a256abd747df4574a8aebefb0c61

    SHA1

    b16e6fdc3e8496d2ba06ab6e10081c9ebcfd68ad

    SHA256

    54ed4393356dd3f969f11d0ceae29b86e9e147cba189205f2d5db270c22def78

    SHA512

    f036e7fd18631f32b3249af21037868f38268f506e29256ccd8b629d694592b10d0921d78efb330cf6d854c71a12c782034c3ac4b9fca6b265de35dfb227cb8b