Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13/09/2024, 00:53

General

  • Target

    a3705042b780e8576dd0678ceb0db8d01d4ea8b9fd170c57a8359399366fe9e1.exe

  • Size

    104KB

  • MD5

    5d4ea5d003e21b89670085c42f217d6f

  • SHA1

    71ab1b8290a8c6493d4c886d8c14ddc4bd0fbf43

  • SHA256

    a3705042b780e8576dd0678ceb0db8d01d4ea8b9fd170c57a8359399366fe9e1

  • SHA512

    cb0fc925b68cd58a7221638455ad3ff59d1f05e2b0af8eee9be15aef77f525359c75252266371586d42ba792ce84d3b54579831da1ad925616350fdf4c858333

  • SSDEEP

    3072:6e7WpHIyRF9ESWu0SWujKsKRsP9fVL9ilV:RqlIyFESWu0SWu86jYlV

Score
9/10

Malware Config

Signatures

  • Renames multiple (3453) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a3705042b780e8576dd0678ceb0db8d01d4ea8b9fd170c57a8359399366fe9e1.exe
    "C:\Users\Admin\AppData\Local\Temp\a3705042b780e8576dd0678ceb0db8d01d4ea8b9fd170c57a8359399366fe9e1.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3048

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

    Filesize

    105KB

    MD5

    f83161b94a47d37ec5c348e40f9ed64e

    SHA1

    6024d3e0cbaf0ad54210ddea42ea6f2962ab402b

    SHA256

    418d7cf317f6d7e0530e10dc869fafb42bd092a6bc65990bec5fb6a0b272b634

    SHA512

    da725a6150d64a36655aff315747194d1dfd8b6b946ad641fbc9177a1d7f4b233f017b0b475898b314843c2e93d5babcbe7686114f97a55763eeb757b8bb1ffd

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    114KB

    MD5

    ef67661dbfad523f2d5b0c3bdd3794ec

    SHA1

    e693dfcf12e81e6683c3faf0e3bccca82619082d

    SHA256

    51a1b892655a487aa909f8bb7da54de53fef4aa1f74aa928660730a85055541e

    SHA512

    f8dd5f47a4898865af210f5cfb92a9ef125a22befa721306ea37303195e6937d88fb4b187dacaa4412766794fab2d2f9f0a87d4ebf2b8d8f60c6a7af71e60a25