Analysis

  • max time kernel
    120s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    02/09/2024, 07:01

General

  • Target

    25b9aae5b5370af81a827f48ee32e9b0N.exe

  • Size

    98KB

  • MD5

    25b9aae5b5370af81a827f48ee32e9b0

  • SHA1

    440eced12e10b312b37877e5b02afacc823b93fc

  • SHA256

    0679fb934187386f9a1a8a3f7cfd08ae7c3d7bb3becd9caf9fa4fdeea1c3ed57

  • SHA512

    d9bbaf87cdea99d6eeee44794f987050a31244a48c0b69cb1fc3e6064c5f53efc61c6a49ed60647ccecef6128216963aa3d160ce38f4253119013fce6ebd377a

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxviYiaEWYMjp:fnyiQSo4iYiIYMjp

Malware Config

Signatures

  • Renames multiple (2926) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\25b9aae5b5370af81a827f48ee32e9b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\25b9aae5b5370af81a827f48ee32e9b0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2416

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini.tmp

    Filesize

    98KB

    MD5

    2df77d5c2959e8d96628807468edeece

    SHA1

    3ea5abad7c0276cb048661394aa09f4b47b170b7

    SHA256

    71b8537ebaf95739c737b87aed7bd35e3b68e12f29f57461e974a69d2bf07821

    SHA512

    29a69d81a996ae1641a496ebc20435093d0e3d3e84f1551e737109b2e5074178cfb58080009fb9ccf2af36174492c52f7de16474105a1a6f04679673cc1b9894

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    107KB

    MD5

    8b45901fff6121c7cb216fa3b5d307f2

    SHA1

    434dd4f3a8d4613cfa3331e46c206c20873989eb

    SHA256

    0a2ab0981b2bdfd4c87cadc35b0445c294fa49d40ec21d09956f21c101496856

    SHA512

    09c6af18ede98564765ecb164f42620997cb31c367a4bf2c8da8bfa9c84c85da521bfcbb57c447a1ba4e17e80897811987529ab36f46732db73cf8a0efd3fe88

  • memory/2416-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2416-70-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB