Analysis

  • max time kernel
    120s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/09/2024, 12:26

General

  • Target

    79958401d0e3d307426deff83f452250N.exe

  • Size

    76KB

  • MD5

    79958401d0e3d307426deff83f452250

  • SHA1

    4869e9b995431f13c26351a891a7048c708e9862

  • SHA256

    e893a68761f110f15fb332d71a85f940f5aa76e8f5ad499e1452fda69f695d3c

  • SHA512

    6e8741feab85d2bffa84df20593361a467f8b24daebc448579308b4a9c0a93c238be828861802590f6ee6cd0fd64c2e3e15940e600d409af33db16af1ba1ea9f

  • SSDEEP

    384:GBt7Br5xjL9A7AgA71FbhvnwR/s4NW2sl4c3KbsvrTgOzkJAopyVFlgLfQf+PZfD:W7BlphA7pARFbhM0KW2s9B4hofAr

Score
9/10

Malware Config

Signatures

  • Renames multiple (4383) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\79958401d0e3d307426deff83f452250N.exe
    "C:\Users\Admin\AppData\Local\Temp\79958401d0e3d307426deff83f452250N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1800

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

    Filesize

    76KB

    MD5

    27464aaca3ef942dc8f926fe5a083161

    SHA1

    5ac262cf486c5a4038fbaf5b69b51dbd746271d3

    SHA256

    f331bd2dc5ec3fb9af765da8934b1876a455e54eeb07814b3c55f5e29119e090

    SHA512

    bd31ab2e30c40e6a4b658fb0371d7a7a2bbcb8022f210309232f3ae1dcf88ce92eb5814955472182b62dddebd2716446c64dcadc9e35cb65d8d6c4d5363a3e7c

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    175KB

    MD5

    89bc6e6dd9d270a392551313fbd83617

    SHA1

    22ead4a333c4a158a95c25d3d277a2df25313e85

    SHA256

    e1d8feb90a9bf15113f6e2c532428a6415501f9fcfe4fde92dbd1cb93fcee3a3

    SHA512

    8b2a0c8dc5dd2b030641e400f5683eb9cc5c4fde50889cda52ae24104ddc8930b51abbc26bad524fe854b3ec1feceef58ec1346a86f4c0ef883424360604e21c