Overview

overview

9

Static

static

7

6bf742556c...8N.exe

windows7-x64

9

6bf742556c...8N.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    120s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19/09/2024, 11:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    6bf742556cc3946b27071532e29d6e7c277898fb666e997def2f7659649512e8N.exe

  • Size

    32KB

  • MD5

    278039667fb2d360feda99d130461670

  • SHA1

    614b4d30437224abf77d23408cb03edd78183d66

  • SHA256

    6bf742556cc3946b27071532e29d6e7c277898fb666e997def2f7659649512e8

  • SHA512

    4f9aa66bab168b892975e93fd3dde3298a625b8ec18b253d5b6d9e0797b5747ab3b25d3fe6af1ff977b7b7dbd92d7dc474f70cd4c200f1ea2fca9fa1401523a4

  • SSDEEP

    384:QOlIBXDaU7CPKK0TIhfJJPbUEobUE51lRtJicszsOVC3xDxi:kBT37CPKKdJJTU3U2lRtJfOsRo

Score
9/10
discoveryransomwareupx

Malware Config

Signatures

  • Renames multiple (3306) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\6bf742556cc3946b27071532e29d6e7c277898fb666e997def2f7659649512e8N.exe
    "C:\Users\Admin\AppData\Local\Temp\6bf742556cc3946b27071532e29d6e7c277898fb666e997def2f7659649512e8N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2220

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp
          Filesize

          33KB

          MD5

          3371b36f78d02fee838533a818abd71d

          SHA1

          cf1d347a0682850bf91f5d5551a7fd5808b3d036

          SHA256

          fa7705649e3d42bba47776f6dbb8fad676452a6cdab409f32f7d7ba95d0e58db

          SHA512

          92cc9c5c0f79c6b14c24e8641f52c6082ce081043ef9826fb03b72573f45b22a7f0dd56f810d70ae0b3a7f3ecbe5d8e3f60aea1cd069ce733d7291ac2f1ea02b

          Download Submit

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
          Filesize

          42KB

          MD5

          572482a2c7106b5effddfae07bd19da4

          SHA1

          e44c0ddd5a0a55c0e5cc1bf2443fb0d339cb1a92

          SHA256

          1e3501c5290c0bef66fa0d6371cceffa9827fc9408c06cb84358fc757b3682e7

          SHA512

          bd828564135065a1c07f21f97b52a9151d3c637287af52b933fd00f65291f69030a4a953ccdb8a8a048f6205eed9f6a602ee92f38dd195dcb83639a717ed033d

          Download Submit

        • memory/2220-0-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

          Download

        • memory/2220-75-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

          Download