Overview

overview

9

Static

static

7

e8a83721e8...0N.exe

windows7-x64

9

e8a83721e8...0N.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    120s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06/09/2024, 11:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    e8a83721e8fa8473abdb1f7d37898eb0N.exe

  • Size

    103KB

  • MD5

    e8a83721e8fa8473abdb1f7d37898eb0

  • SHA1

    babf076bd6cb8ef5683c819ca8a9e4af2e7b3ff0

  • SHA256

    472340741ee7dd2c5740518f92d7d4494f08ba2d0e909ff8ee1f61fa49d55d37

  • SHA512

    62bc89fce7391828155609525d24fc8d2853d20e9542d01e7951c8224c55491a91a7001496e9a46277752e94fc519bfb02ac4ab3dbbab583dcdfce7296891348

  • SSDEEP

    3072:hc2JaP9iMGfUSaOy9SnJUwFU+FUhFUeFUXFUqyqKS:K2JaP9iMGsSaOy4

Score
9/10
discoveryransomwareupx

Malware Config

Signatures

  • Renames multiple (3140) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\e8a83721e8fa8473abdb1f7d37898eb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\e8a83721e8fa8473abdb1f7d37898eb0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2368

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp
          Filesize

          103KB

          MD5

          1287d4137566c3ed3bb37bb8aff6b9f9

          SHA1

          aec73eb73b386ecb333c337ff425e5eec04f1df5

          SHA256

          e95ff0c7e191cade8426c64d721b29d19a70b5d0ac073d4f378c832155ba2ad9

          SHA512

          81de03fc8ce03ea6cdecddcdc0431365af287ebcf56bc8f16d2ba40b8f61ebbe2e5d3305ee27c1c262cd668b6c6b377df50f7331a52055c6d9eb27ddc45c61c5

          Download Submit

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
          Filesize

          112KB

          MD5

          623e9dbbdf6b01d8de61fbb03cf9d82e

          SHA1

          32837b16f6bbce45d2492ee5a305389e45f66842

          SHA256

          5fb10d949d3e031f1b5108541ea451ca2c223ac86a78db9ec0e2918aa40aae20

          SHA512

          802b238865a9b91f17f451ba5d02e70facd9542415f3a67aa53ba6b488ae92e7929a39083b3deaa8116e9c7415bfc58acf05d905abc838fcd1bf9dfae73e97fc

          Download Submit

        • memory/2368-0-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

          Download

        • memory/2368-75-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

          Download