Overview

overview

9

Static

static

7

5ff5c7ab23...ef.exe

windows7-x64

9

5ff5c7ab23...ef.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    146s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    08/09/2024, 02:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    5ff5c7ab230279ccab65b962a26a21ebe4077dcc1dddd528e8ad3298851cbaef.exe

  • Size

    68KB

  • MD5

    eaf9a01ca02c980f45eb3ff7cccbe171

  • SHA1

    c8aff2148c2edc2285b575eea9def2d823d4a690

  • SHA256

    5ff5c7ab230279ccab65b962a26a21ebe4077dcc1dddd528e8ad3298851cbaef

  • SHA512

    8c6648b9fd766e64d27c2c88b8428f15cce0e54d1bf5031f4b53db26bd1372253cac000ed76ce5ea68a367e5ab08a23e17d7abb08ec7fe619209577356b71859

  • SSDEEP

    1536:CTWn1++PJHJXA/OsIZfzc3/Q8zxY5RWxh76b:KQSox5b

Score
9/10
discoveryransomwareupx

Malware Config

Signatures

  • Renames multiple (3457) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\5ff5c7ab230279ccab65b962a26a21ebe4077dcc1dddd528e8ad3298851cbaef.exe
    "C:\Users\Admin\AppData\Local\Temp\5ff5c7ab230279ccab65b962a26a21ebe4077dcc1dddd528e8ad3298851cbaef.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2344

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini.tmp
          Filesize

          68KB

          MD5

          47d2e8a8c0297c627fc34fb8201e7627

          SHA1

          2a2d0e0d71d135770ca3fc236bd4decd9495cf0d

          SHA256

          6426994bb14e9c259d9a866020a4d9c7ccf6bab799b39664befdd2a351d143cd

          SHA512

          c439b774362664444f3c6bacbd42ed0b74a3f1d5873f2844db403414e57270bd5fa21f6af2d352a1e2f89c4556b2be1079da3b385bbd96b668aac39a150fb071

          Download Submit

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
          Filesize

          77KB

          MD5

          e02a1fbfc0c89aa19ee4615a253e0b54

          SHA1

          c2474ab5d2c0805340a3eb8daea43039a96c460d

          SHA256

          6f65d8b7d5790785d6b6b71f44176b6e0bd1e4eb6389673ea348122c895cf485

          SHA512

          01e661a3ed939752fb771f847d0a09276d4ac0332c19fa8aeab976c2742ba858824aada25adabfbddd64ded7ad0466923f01008f957ce7c5a93f5538c2e5cbd6

          Download Submit

        • memory/2344-0-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

          Download

        • memory/2344-69-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

          Download