Analysis

  • max time kernel
    120s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2024, 18:59

General

  • Target

    b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe

  • Size

    60KB

  • MD5

    a99475cfc534b0a3a8407d929be94a00

  • SHA1

    2968c07ce529ebe195dae21d381dfdba6bb5eef7

  • SHA256

    b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26

  • SHA512

    8bcba53622ece2af910f9025bb9f87ef0b386ad3ab0498235bfbb5977038b218f7f3bce250aae5a964d675d897c23a99450b47542aefac7dd21a2b826a690c7d

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rU:V7Zf/FAxTWbiG1i

Malware Config

Signatures

  • Renames multiple (4648) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
    "C:\Users\Admin\AppData\Local\Temp\b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:5112

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

    Filesize

    60KB

    MD5

    84678395348e9757add65eed9d6de76d

    SHA1

    85eb8dec04a4db33e5e978b3529ea658354dccd6

    SHA256

    453187380e1cb250425bc6909ac7823ab8c6db969b9bfe68ee54fbc128df6ce0

    SHA512

    6e1da1457896027f194275ed2daa7b6aca1acca4782d3ca7dc55f9f73785900ff26c656ede6af2aaadbc70b45a9af66ff4de4dced2fb1d9a23fcb5a9e43d0ce3

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    159KB

    MD5

    2930423b1312fd5d2da50ebf76593474

    SHA1

    e6b88ef596e0f94c290a0e35408431b42ca54c38

    SHA256

    df3bb1182dd2af5102457e7f3a574b2e7615c2e828f57e0110e349c5e4ce6993

    SHA512

    0776895dcf1c7f326af7cd607c8b6ee62fcc088203cf26dbd7521ede7151607e5b9922bfed907912d422f83057b30d212d3aed93e965678af7760296fe164988

  • memory/5112-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/5112-924-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB