Overview

overview

9

Static

static

3

349d0d9aea...0N.exe

windows7-x64

9

349d0d9aea...0N.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15/09/2024, 03:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    349d0d9aea3c80085a0c0bec12a92de0N.exe

  • Size

    81KB

  • MD5

    349d0d9aea3c80085a0c0bec12a92de0

  • SHA1

    4397b48db70056d778375713e30843cbb2a0f2c9

  • SHA256

    96b9001310418aee85bee7785bd4cd2839428dc1dfd8ec1028e80efe9e44ccd0

  • SHA512

    6b88233ad61fd3b9bc2c04c51a583e831cb5bef7d940276165e9af59eed304812fcfc83f5c516a43d06cd376d55aae3ae626a05de9adac4883d2ae707fb853b6

  • SSDEEP

    1536:W7ZhA7dAZ1++PJHJXA/OsIZfzc3/Q8zx0Cq/8S/8dYG:6e76mQSop8i8L

Score
9/10
discoveryransomware

Malware Config

Signatures

  • Renames multiple (2948) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\349d0d9aea3c80085a0c0bec12a92de0N.exe
    "C:\Users\Admin\AppData\Local\Temp\349d0d9aea3c80085a0c0bec12a92de0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2232

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp
          Filesize

          81KB

          MD5

          3cf394c617829c1f3abadd7591831eef

          SHA1

          50fad23037cc2c4484355c6e50b466d9eadb506e

          SHA256

          8fd539bccd1ce502df2dc036a87b9d420efbfead89c36536303a7b72cc5c314f

          SHA512

          cd4ef9c1de63c7753e56c002f95df1d3b2e9a05f9dd7d35ef388c50be95afa9237f118dc0139fd0a961db99448742540112aa525c5db8f12bae3be4a379d6b46

          Download Submit

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
          Filesize

          90KB

          MD5

          2179ce901725962795db5435306410f9

          SHA1

          9a8cd99ce2cb89e5aeaf06bd897b03f50580521c

          SHA256

          d6a07acfee4ea2e6c3095b3327364da801c24905161a9f69903f4691953be7ca

          SHA512

          3b4c2e89caf2a6d0b5a22ccde26a0031995a75e96b4d8106ff9433bbd3a03cf4d6764baf616516568c385a112282b008d24e8ca64422c5c1bb54b6c951354ad9

          Download Submit