Overview

overview

9

Static

static

7

bc3434c81f...0N.exe

windows7-x64

9

bc3434c81f...0N.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    120s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    01/09/2024, 17:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    bc3434c81feafe3b697ca5997fd9e790N.exe

  • Size

    48KB

  • MD5

    bc3434c81feafe3b697ca5997fd9e790

  • SHA1

    ec7f153abe30e37d3276cbf2eda519a27da9bd4a

  • SHA256

    4ecc0c75abced3423b1eb397caaddd52d4072deb06fe656f8e1f171c19165bef

  • SHA512

    3de68bac7fc8cf4f36052b0f018cd3fd7b6156c68549fec9a11a5259a047a3690c577165d8ac0ae93be3af0bc13a0aa0ccb161eb8242d90c8059bdc74912459b

  • SSDEEP

    768:kBT37CPKK1EXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKeinMdu:CTWUnMdyGdy4AnAP4W65

Score
9/10
discoveryransomwareupx

Malware Config

Signatures

  • Renames multiple (3405) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\bc3434c81feafe3b697ca5997fd9e790N.exe
    "C:\Users\Admin\AppData\Local\Temp\bc3434c81feafe3b697ca5997fd9e790N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2112

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp
          Filesize

          48KB

          MD5

          dcb8f651d1839522d0a98289cde7eee5

          SHA1

          c180272220969cfa651647b30461c2d6a0e6caa3

          SHA256

          ae527a46673b2d15d6cd5df6b6ff2b34c34b5f946f118efb184a670f3fe2a85c

          SHA512

          8066b0d6e346748acac3fe396708ea6a3e2248ced973d4b6aba440d5cd7a50f9e6a410c9c0648272b26fb656ff364662e7485eaf16323c6fc8964f18fe3a9263

          Download Submit

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
          Filesize

          57KB

          MD5

          077af70d1e501821776fc4846593c616

          SHA1

          8795d5171e46f82a0e0723bdcd9a9fab2f74f7bf

          SHA256

          9200f593f3a63cc4fbaaf5b6982728dc0904b7d7094e17a2a54f8a219e38c1d9

          SHA512

          37e63d71e439748db233fa43b23ec7c036dacf0613317bb69ef354859efb49bd6d51ed0a86eb91626cfd71d6a3d0aa113ab8ef5abede82d779aa77660f25f46d

          Download Submit

        • memory/2112-0-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

          Download

        • memory/2112-71-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

          Download