Overview

overview

9

Static

static

7

ed00cc273c...0N.exe

windows7-x64

9

ed00cc273c...0N.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    120s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/09/2024, 21:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    ed00cc273c584206065ca82d93a909e0N.exe

  • Size

    29KB

  • MD5

    ed00cc273c584206065ca82d93a909e0

  • SHA1

    e8fd9c5b2abfdcca5ac3a60d251354f4ad2d1c88

  • SHA256

    ccb17b72d2db80031081c30c2d38cd7d3dab993505576a1e9e4e5b9bef9ebc4c

  • SHA512

    5fe76d7454c0748d2ab9fffa53a23a2a6e27e956bd1daecff0c06413c9a7923e7e227a5fc2b31ffa20152a347154e168d55bfb907d1efeb10a5665ccedf9db84

  • SSDEEP

    384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9+DADXM:kBT37CPKKdJJ1EXBwzEXBwdcMcI9R1+

Score
9/10
discoveryransomwareupx

Malware Config

Signatures

  • Renames multiple (2953) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed00cc273c584206065ca82d93a909e0N.exe
    "C:\Users\Admin\AppData\Local\Temp\ed00cc273c584206065ca82d93a909e0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1292

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-3533259084-2542256011-65585152-1000\desktop.ini.tmp
          Filesize

          29KB

          MD5

          9e83492ed74e5a56e23af27f6d2ad5e8

          SHA1

          b331fbb63600b5d976bac5d658318aff366761b4

          SHA256

          30b07adc0dd11ab15134590097a22b6127e4a9478126a7c496498b7b8fc960d4

          SHA512

          f818120570be510492cdd6286e2268e22540532c3d00c25ea2e459cda604e5836c77d62a94ec6effc179726f21924784e624f5646a835811c6404879189b81e1

          Download Submit

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
          Filesize

          38KB

          MD5

          89bc82db5e836ac67284b6c07912a61f

          SHA1

          6b82c3d192a4653be429d3499e14ae808aec513d

          SHA256

          20527011fbf5107c952a8d21d8d01ab27907a01569b0552d400b29fc63003dcc

          SHA512

          cb8f4d18839507e5788b812203457acdcd98b2caf71c4fcb66f0531c5a8e27e280e2c944c36232ee0be036d0388320f670dd018a556182f011bafaf8b0ec7029

          Download Submit

        • memory/1292-0-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

          Download

        • memory/1292-64-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

          Download