Analysis

  • max time kernel
    120s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/09/2024, 20:00

General

  • Target

    27b2329284bdeb1349a9213d873d4760N.exe

  • Size

    47KB

  • MD5

    27b2329284bdeb1349a9213d873d4760

  • SHA1

    00347ad66206f677a962049d2b031faff1fee91f

  • SHA256

    b11eac059d3b76c9873ee28882e7149bac74e484493b34d623246d609c94fc77

  • SHA512

    461e8761f3f01c09e447e80a7bd0425d170459cc09e0ba0e1ff6b6a5514bd0581ca455c0ea215dd29a8877a7cfe7aa23395cdfa62d97af4efa88af8ce2bcb806

  • SSDEEP

    768:W7BlphA7pARFbhM0Kkq81LOyq81LOd+QRI7c7x6e:W7ZhA7pApM21LOA1LOTRcwx6e

Score
9/10

Malware Config

Signatures

  • Renames multiple (4673) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\27b2329284bdeb1349a9213d873d4760N.exe
    "C:\Users\Admin\AppData\Local\Temp\27b2329284bdeb1349a9213d873d4760N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2232

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

    Filesize

    48KB

    MD5

    ad627bbed42eb9d4394f0e42dc28d699

    SHA1

    b5f90654fa82d005abf3f2bb87d44039e4b36b9c

    SHA256

    c9b9404cbc7343c43a4ca8ee31571a161a2eef3b55ccfd8be7434a162d6fa19d

    SHA512

    b34f26d38d38249eb7ce60f9ee59fdb4e915c7bee0b1221f4f567c599002effb298bdca0c550a5baf2a109f26be68a619118eb5b15dbb462f12f5ad0b048a707

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    146KB

    MD5

    48a033d4222a81422a28a1b919ce1895

    SHA1

    1346804753b9972549b6b07ecba1b0afa4309378

    SHA256

    f6de8dfe0fd39b2dcddfa7675fdf702a9cf0694026bc4eb008f637a43a586a83

    SHA512

    68e5de3e83e6d58d508219e3728c64ce273a4c51e6a8945c421ff4790eb49952e75128f74c7cb478050d94d5f258b360b72db563dfa25871298ab6a23069f030