Overview

overview

9

Static

static

7

5a96861236...0N.exe

windows7-x64

9

5a96861236...0N.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    120s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    11/09/2024, 07:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    5a96861236833cafc5649cb044069350N.exe

  • Size

    28KB

  • MD5

    5a96861236833cafc5649cb044069350

  • SHA1

    3845d592808d29689e469f906f3d73f5629184bf

  • SHA256

    7d7e8fecf89074d9dc4e01d5534662759a4f01df947f195be5656315c654e161

  • SHA512

    711b2dad47735a8d53878788219dd5c3df745b02e913fda3b6bf1399cc18bc3a08a9e0727273db068c23defdb16b0a2b9ed83993c406034b5311c92f00645987

  • SSDEEP

    384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9j5:kBT37CPKKdJJ1EXBwzEXBwdcMcI9V

Score
9/10
discoveryransomwareupx

Malware Config

Signatures

  • Renames multiple (3459) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\5a96861236833cafc5649cb044069350N.exe
    "C:\Users\Admin\AppData\Local\Temp\5a96861236833cafc5649cb044069350N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2196

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp
          Filesize

          28KB

          MD5

          a5177cae9438d405b70f5f968b030acd

          SHA1

          0979f358b357bcd80eaa18f33ef7ddaacbdea8d8

          SHA256

          c12a15f32925048b4c80898a8aaf6ac212d8393c1fe21889f3b38969db2d40ae

          SHA512

          c2963878ff22571d84816fcaaac79b32d063f136ba6ae85268ca3245520f6fce4d5efcdc29767ae3d2945b7adfe21af4a22be96d10e2a3698ef3b275186e2ad9

          Download Submit

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
          Filesize

          37KB

          MD5

          0977c6e3a917a6ffc626128be5e9f921

          SHA1

          5b38812552bb3b1c1f99219a927a048edcb9c663

          SHA256

          6fba151c8ca9b28b362c13e293baf1b1c6e4b15faca5a3243c93139ea50380c9

          SHA512

          8ddb1c3989a835016b4f51984f9fc3cb51f6e68db9b20d9672bc9a88f55194489f2d8313905f09e179b244f292c98f122357e99a605c6812251baa5ecce6ac75

          Download Submit

        • memory/2196-0-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

          Download

        • memory/2196-71-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

          Download