Overview

overview

9

Static

static

7

aa38459f00...7N.exe

windows7-x64

9

aa38459f00...7N.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    120s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21/09/2024, 18:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    aa38459f00c186028773c38c93eb2251ba19a5b601845d36ce93a904f30b01c7N.exe

  • Size

    55KB

  • MD5

    6207fa0735bed012084cfefaa57b0830

  • SHA1

    d5ce57cd3839d530e57e1021e0dd430776e2826b

  • SHA256

    aa38459f00c186028773c38c93eb2251ba19a5b601845d36ce93a904f30b01c7

  • SHA512

    a8ee3efab7a2e294dd9dfeae74016757a987d7e8dbeebc592d8a04d2b6db0a2c7234a31aad5e444687699eabfd9034e4ec9bd15edf3661eac7a47cd7c71dfc83

  • SSDEEP

    768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFIz:CTWn1++PJHJXA/OsIZfzc3/Q8IZTrQ6

Score
9/10
discoveryransomwareupx

Malware Config

Signatures

  • Renames multiple (3197) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa38459f00c186028773c38c93eb2251ba19a5b601845d36ce93a904f30b01c7N.exe
    "C:\Users\Admin\AppData\Local\Temp\aa38459f00c186028773c38c93eb2251ba19a5b601845d36ce93a904f30b01c7N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2316

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp
          Filesize

          55KB

          MD5

          6d6f150751c565e749fcafecf0a030b9

          SHA1

          364575e24c0853ca1c81d26bea26078aa083f971

          SHA256

          af5c4fc38962bfa54694fbc03ae20bda68531c0e09e1aff394c8cb5c12c6130d

          SHA512

          fba61cf1d5a2a9c36d3fd636110e79e7ffb26fd3484581b2021103b8ce86d33d8ef147ae0a01f55b28c84699063c3d387e05bbd6808387969d96e739208bddf3

          Download Submit

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
          Filesize

          64KB

          MD5

          77f224210053fbde684cfdd25da5b29d

          SHA1

          76384fdd803436d843bd55bb85901903ad647a0c

          SHA256

          d4ffbb59b75183c7fc5275003d931a3caf177644d4a1561a3e139b4e569af457

          SHA512

          dfd73eed718f78a5757d28ae339b75e6fa1e7b31149612e1cd9b8f48d166c3c1b6a87aab6caef2daa9ae7b884694723e31882d87656facea01373e87551fae03

          Download Submit

        • memory/2316-0-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

          Download

        • memory/2316-75-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

          Download