Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    28-09-2024 01:31

General

  • Target

    365f2f720df1399beca728099c30411f88f76d153a2e45f75014b541d8baa684.exe

  • Size

    65KB

  • MD5

    77e8edc1b8e63f373956d24f55f6b7a6

  • SHA1

    05f27c9143af22e512b76f682c56b67fbcfd3a2a

  • SHA256

    365f2f720df1399beca728099c30411f88f76d153a2e45f75014b541d8baa684

  • SHA512

    e6a852f23e7eb305daacbaa9cd8a3ae7d2cbb8dadb965f79ed9cbaa3b1b0dec77b3c7de9dec81a0b0bf8fcdd7b2624092bf85e2398682d7032f038ad5d90d871

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/tiJFEFF:V7Zf/FAxTWoJJ7TTQoQPyF

Malware Config

Signatures

  • Renames multiple (3571) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\365f2f720df1399beca728099c30411f88f76d153a2e45f75014b541d8baa684.exe
    "C:\Users\Admin\AppData\Local\Temp\365f2f720df1399beca728099c30411f88f76d153a2e45f75014b541d8baa684.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2380

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3533259084-2542256011-65585152-1000\desktop.ini.tmp

    Filesize

    66KB

    MD5

    03d96614f1fb90bca121739b37b2fa62

    SHA1

    2b4132b15dd0e4cbf50dc452116e644dcd25fd3a

    SHA256

    42e5a88c591ce78939769cf9722fd1f4e662742afc505bf979de9586093032a3

    SHA512

    985acf5fe5d1b35ef3b4a5a85c96798f63abff147c340d37eff48ffbcb33644189adc42a4db586f252875b41d60433276d82be5de81efb2c93862624a3b301db

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    74KB

    MD5

    c1c1f1c4ff24cf312a1baf44232055a6

    SHA1

    d1f3ccc3666994f5e7c4236fc49fe4dbece5082b

    SHA256

    62d17262bd76c7e3eed7fb3fadbd64723bde7c3ff79fa4c4d0be47cff70232c2

    SHA512

    0f0c315862c2573dba519a3f87c03e25074f504ebe0b31514addc71964f121d33401df157c4de017e66fe20234cc601b2e15fc2c3755c4cee253a26cbbd7b5a0

  • memory/2380-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2380-74-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB