Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    18/09/2024, 22:23

General

  • Target

    6517123ec5ad03d6a931f4a31ba16dcaa346a862cf198f352731050ffb83fcb9.exe

  • Size

    106KB

  • MD5

    751c50b61df27930858583bd37e61138

  • SHA1

    dc45ecc13fbd5c24181fe9ff9eca8c4e5a5e5d9f

  • SHA256

    6517123ec5ad03d6a931f4a31ba16dcaa346a862cf198f352731050ffb83fcb9

  • SHA512

    66abf34d6c732c8b0bbfdcc014aa0d01b11dfaa3306db42975cd9a06102dea78af9f67df5153210eb9435ef8af04406e8eaafe040ee9b8fdf7366125f552cad7

  • SSDEEP

    3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZHfFpsJOfFpsJ6Xu:RqKvb0CYJ973e+eKZc

Score
9/10

Malware Config

Signatures

  • Renames multiple (3447) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\6517123ec5ad03d6a931f4a31ba16dcaa346a862cf198f352731050ffb83fcb9.exe
    "C:\Users\Admin\AppData\Local\Temp\6517123ec5ad03d6a931f4a31ba16dcaa346a862cf198f352731050ffb83fcb9.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1300

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

    Filesize

    107KB

    MD5

    e19af5ead10959ea6771d7441cf31ffb

    SHA1

    fdd163cd7a9062db2cefd79c9bae0f6c166e4a34

    SHA256

    8d14a0d614237dad9ea5d057e07ab3018bcd4a18fc2990fe17bca1d334f00947

    SHA512

    52eaeb38bf7e11e00f645a4cd0ec33b5e2606084fc4b4a20d49abe743e6c0ed2876fa06aa70fbd98dd8faf5c609ab4b51a86291b54e50df62ed2fc754c6234ef

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    116KB

    MD5

    03fab68af014c547ec9769ffd636529c

    SHA1

    cc97eb7c4a51b57987ec5cfbd03088c67de3bba2

    SHA256

    12260f3fd64881273fc9e4c1a69fb36df8dacb5b5c8858539aac977156b8d8ff

    SHA512

    8fcb58372400e135fe0aaac6d8b0098c7513cdae774b57cb58e833a598cff939285e13368c8883addb6871cc5e19096f952d7e754e3ff67104fb7444b52aab60