Overview

overview

9

Static

static

7

2f638e271e...0N.exe

windows7-x64

9

2f638e271e...0N.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    119s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    07/09/2024, 02:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2f638e271edac2a3166f03dd2c8e60a0N.exe

  • Size

    64KB

  • MD5

    2f638e271edac2a3166f03dd2c8e60a0

  • SHA1

    5d1eac8a1e9e03e62f9c0ebc0b8b92d9ee75f2be

  • SHA256

    b7871ad3fd341ed8b723d5af25a80770d2d7711bfc6e8ee3633a19c914fc1ce2

  • SHA512

    4e18f41817fb255babf7afedb5ab6150c21aa4bcd9dcd7ca14a360fc07701b9a5bf80880fdc3be78762f78319940a8e461432f4b06b20b07c0a0dfadace0be49

  • SSDEEP

    1536:V7Zf/FAxTWoJJ7TTQoQ0dsGagj/NQdsGagj/NR:fny1oRP

Score
9/10
discoveryransomwareupx

Malware Config

Signatures

  • Renames multiple (3255) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f638e271edac2a3166f03dd2c8e60a0N.exe
    "C:\Users\Admin\AppData\Local\Temp\2f638e271edac2a3166f03dd2c8e60a0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2180

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp
          Filesize

          64KB

          MD5

          4be5cec38d11e05dcf206588e14042f5

          SHA1

          761fba57b3e82ff2dd6279c8e4df7b6dc245fee8

          SHA256

          363f81b1c631e3acfb4d72f04edfa4261e66188e3ea96d5b3c98faa2b3536e0c

          SHA512

          6c3bb3ef8f0a3acb64e299a9059e85badd33a2603a224f0d4f2ee1612b48fa36492df514152e9c21c3dc35081aa441c6ff83cf53bd6ba15bb225ac39496bf7c2

          Download Submit

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
          Filesize

          73KB

          MD5

          d441e874895ddeadcf5ef695fbb02f53

          SHA1

          6d1228d33f84564ba623dc9d9219b86e4e6f1b2c

          SHA256

          a2f2f504531699594ae2d32bcfc5ebc59492b8a7df07f43d3218e2683a0e6161

          SHA512

          4409f639856046ed2b9a20bf41d9136826fdabe8f4adeb60574f7dce720f90800b7550f19cfd3de58afaf0e4ac1976b12139dd850f7305e013ba057488a6734c

          Download Submit

        • memory/2180-0-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

          Download

        • memory/2180-74-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

          Download