Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    02/09/2024, 04:33

General

  • Target

    11930d4256ee3ccac0512c66fd573700N.exe

  • Size

    45KB

  • MD5

    11930d4256ee3ccac0512c66fd573700

  • SHA1

    5dc98f9b3f814858689483c39bd6b5b78f6f1913

  • SHA256

    bf7eabcd2a9d3157034e7d764098f76507b6d60d2d8ddf727c4a3cd86e5e4ac6

  • SHA512

    c268927244b398641ecd309ac8810113fd12dc2c801d5ce90201dcad59ba1a0e872997f81d923c54be63b712d093ed96b4aa819636ba5f0db1c478fc58254686

  • SSDEEP

    768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5ltIIRIUI0n0uI0n0q:W7ZhA7pApM21LOA1LOl6AJn0Wn0q

Score
9/10

Malware Config

Signatures

  • Renames multiple (3074) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\11930d4256ee3ccac0512c66fd573700N.exe
    "C:\Users\Admin\AppData\Local\Temp\11930d4256ee3ccac0512c66fd573700N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2020

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

    Filesize

    45KB

    MD5

    d7539fe33a65bd5f05e33e900b1cecf3

    SHA1

    ae90d949a6a7a6b496890da0b1711bf7086d7584

    SHA256

    38898b56a3ef52802b94cf5316fe26d42a2e640ecd4e34a2016082a722a45ac8

    SHA512

    84e53f1a7f48fb5f3ab8300c063fa4aa61c61a81ef539cf63c9f74027374c76a7e1bab8e3f0f7958fe0e8d810169a1e17561a1fa414d8979a272ca1fd055e29c

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    54KB

    MD5

    bd39af7faa8b790aebf8ff9eed468b49

    SHA1

    b690165442465cf39ddb6b95723791dbadd0aedb

    SHA256

    eb79ca69f6c82dfe28befe4745a01b6b0a14ce03cca87c00e6388cffeae31004

    SHA512

    e21811bbc27ac697962fbac29bf5d34044ecb3dedd309c94ab8710dafb1f917e7fa5dc923c6939dc55b0a2770d16c7049bef989b8e17f979bc0aaf68c9ba87f6