Analysis

  • max time kernel
    120s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/09/2024, 01:16

General

  • Target

    9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe

  • Size

    109KB

  • MD5

    1b90e32357e4ee996f7bfe5738c2de30

  • SHA1

    a261b2c52b036609eccae9940532889bccb3edbd

  • SHA256

    9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bb

  • SHA512

    957e8c2d34241859c3dbf8db4ebc04ec18f4ea49ee9eb3af1ed868edea63d63f47847afcfc6a583583c99569ecb401231802458a977e0339c6bad327b008a7d9

  • SSDEEP

    1536:W7ZDpApYbWjIlE77ufL2e+efZwZQ/8S/80PqPIUpCUpiPZ:6DWpwE7oL2e+efZwZ08i8Q

Score
9/10

Malware Config

Signatures

  • Renames multiple (4346) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
    "C:\Users\Admin\AppData\Local\Temp\9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3548

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

    Filesize

    109KB

    MD5

    412a30b70479adc0f99d9a9adde95966

    SHA1

    ec2bd8891371c8885606ee26747117a2b96e8eb8

    SHA256

    fd36a47d03e9c31f9d4f4e9b34f0052172a71e53043a49d85a7e9fb3e6e8a520

    SHA512

    bd18552ea9394cf89aaf0c36538b315dadbb92fcfb9d926c7e27d0c59fdebcb54c58ef5cffe02437fcadb15e235debe4d4ea56046686718e595078a68bb91eda

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    208KB

    MD5

    8b121ba138ae62d64c57e9a347a75cbc

    SHA1

    27ffd93ca347e14cc5025b09100cf369727d509d

    SHA256

    b566d95cee2b54202d8cdf02874aac5d70cf7b4190ea22a489886612199a13dc

    SHA512

    8c54e4dc677cd34db859a270a1ad33b1b7fbea20b77ba634bad2c43e8125f84e883f1067accf0a9b0b24e05bcaa5a14b4f74d888a641e5d24f7809e9170b82bf