Analysis

  • max time kernel
    120s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/09/2024, 08:07

General

  • Target

    7d9ecbfb1992b4f7180125b8dc6a68f0N.exe

  • Size

    34KB

  • MD5

    7d9ecbfb1992b4f7180125b8dc6a68f0

  • SHA1

    9bb0775e9da9942ae8028b50276062e23b3bc186

  • SHA256

    6b95b7f723db748a364c9109dbd82bef925ff5747483743ec48a451f600dfcc1

  • SHA512

    7f0159d0451218b6767b2e5b45d52fa8a1e7088594eb7b33b35fb22cdcbfd9b5abc02a9ffdb9bbe3079fc53140515e422a37f306ec1caa20bf8e2fa5b6dabf83

  • SSDEEP

    768:kBT37CPKKdJJBZBZaOAOIB3jM2jMO/7OSC:CTW7JJB7LD2I2IbSC

Malware Config

Signatures

  • Renames multiple (4643) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\7d9ecbfb1992b4f7180125b8dc6a68f0N.exe
    "C:\Users\Admin\AppData\Local\Temp\7d9ecbfb1992b4f7180125b8dc6a68f0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2124

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

    Filesize

    34KB

    MD5

    8716de494fa7f670fc45ecdafab0c8fe

    SHA1

    ab1d59a4fe6ba064e4e5cdfee3e72e09a854df07

    SHA256

    121607308dfa9ef97f1a87a09838231330f1bf7d192122a1b7e8dac6ba52cf24

    SHA512

    53371e3e60572c89e6afad61c7d711e5772e7bb4966fc0b1b580caa9c69cadc6dc9f738d0af1aa51b9e431738315a33f5bb9606bd84e3c3bc45927f15993ffd4

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    133KB

    MD5

    705fbd372f56ca94e4e2d21902952dc0

    SHA1

    7ca9bb9adf3917ec0e44bf228ad3515320e29c5c

    SHA256

    2f7a17b1e07a0549dfb010647ab710857fc659f41b163c42affefc72ca3687ed

    SHA512

    71dff779e65eeb30ad4876484172caa81262819cd3fc5fc412490222824ae92a897ea57307120e43ada7b5e0de4677c7bada85c163726d65a77948765880060f

  • memory/2124-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2124-954-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB