Overview

overview

9

Static

static

7

7ee32f9515...0N.exe

windows7-x64

9

7ee32f9515...0N.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    119s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/09/2024, 23:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    7ee32f951596fb17dbe3d8c8474bf820N.exe

  • Size

    92KB

  • MD5

    7ee32f951596fb17dbe3d8c8474bf820

  • SHA1

    d728186fe71a1cac049c3cab5f7ffdba093110d0

  • SHA256

    83e6fa3c1055d5d49fa069e125adf700cde88f33ad4e964fbe95454c442120a1

  • SHA512

    d5aa7388e23f2922d6a1683e8f96bb601529825d1fc91019a3a27f4b615dd5c7323fab6fb9b16194004c450da5a7a078437b61a82c597facfdcd03790ea0faf2

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxY5a8hk7:fnyiQSox5a8E

Score
9/10
discoveryransomwareupx

Malware Config

Signatures

  • Renames multiple (2829) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\7ee32f951596fb17dbe3d8c8474bf820N.exe
    "C:\Users\Admin\AppData\Local\Temp\7ee32f951596fb17dbe3d8c8474bf820N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2400

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini.tmp
          Filesize

          93KB

          MD5

          3185623df74e0cf8ca5f8de0469050c2

          SHA1

          fbcba8ba0a56a0f545400d0d4bfab1ca4554747d

          SHA256

          895c0375f993a1a709e7331a3a4ede9e12b71fbd20de6b39ea1563b7656ffaa4

          SHA512

          0dafe7380d7f894df32c62b528f0de6c6dad023b2b3fed6a31f88d1750a3cf14815e64359a7d1c8b5c20608b1c0eb2f075bb3dcd494c4cd3a7df13716ff01a5d

          Download Submit

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
          Filesize

          101KB

          MD5

          2962950e9057fff1b8a7521c85ecad9a

          SHA1

          6aa7d6c53a37bba753a028e9cce73e74e7587f60

          SHA256

          834ef944ee26e6f4a3af88b23162d697b157b50f5734219bf1b34e24af739129

          SHA512

          632bcd67fb4ec3b63b672bd94bb1eb1b20114d943da348e3f3533b8ff64c671d18a5c8489066f261eae446a641afbdd1dd91158d49ee95f27bea35be1a1e3c2e

          Download Submit

        • memory/2400-0-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

          Download

        • memory/2400-62-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

          Download