Analysis

  • max time kernel
    119s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    19-09-2024 05:30

General

  • Target

    e1b53780b8ab3d5115632aebde8991645c5859a0017203b5c70b92a2888e41fcN.exe

  • Size

    51KB

  • MD5

    8cc6ea8a662d31862cac4201bed09290

  • SHA1

    a4629ac9c804d55ca67f54e7e2a91940c9f6cecf

  • SHA256

    e1b53780b8ab3d5115632aebde8991645c5859a0017203b5c70b92a2888e41fc

  • SHA512

    44ac8e3e58cb6cfc30b0a594700187b66948afa80f1afb08c0ba6f8afd15aa86af6d6f4451f01efb8d7d8c7256633e6fc60a69655342bf56baad7aa3f2ba682a

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9UwB:V7Zf/FAxTWoJJ7TiwB

Malware Config

Signatures

  • Renames multiple (3251) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e1b53780b8ab3d5115632aebde8991645c5859a0017203b5c70b92a2888e41fcN.exe
    "C:\Users\Admin\AppData\Local\Temp\e1b53780b8ab3d5115632aebde8991645c5859a0017203b5c70b92a2888e41fcN.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1328

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

    Filesize

    51KB

    MD5

    420b059e53b72b6c06c8763c2799a57a

    SHA1

    5001aa45e005bff520c4ed8a502a2fd6278f69bf

    SHA256

    113be8ec0c60ca4f1e4f08997603d3cce20939df216e56b5618aafdaa1652ff9

    SHA512

    6cf75b49ce6064e316ae1c7bf51ea0e2d574122d7630c90cbb76545d7090e02aa96bc42d5b1ef1fdad0ec842557e9260d6023f6c19f5f4240d30226dd0f0b1e4

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    60KB

    MD5

    f1165212efca0da48777804ba2fc1092

    SHA1

    82877c3d3b65cdd6b13ec9f9187c305cbd95e575

    SHA256

    2a8c9e8d06d48be0e42df20c6745edcd73b4a23f670c31b3047d6f8ee71182cf

    SHA512

    ddad450b7b838c7c0e8ed0c66bcf10667c8744ca5341b24bba065abe8be2080a67a9d5faae60f8f9c560379c19519264e83d0a1044bcc165874f3e14b8f03bbf

  • memory/1328-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1328-70-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB