Analysis

  • max time kernel
    120s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30-09-2024 09:36

General

  • Target

    d512e5a1c13018ddbc17313f30828f89e2f7b43e66079029e9d326119420bf22N.exe

  • Size

    84KB

  • MD5

    a92a82af4f32acfe69eae3ab46557b50

  • SHA1

    2adeef9d7b3ece0643dfae22f8f983eee8b79d74

  • SHA256

    d512e5a1c13018ddbc17313f30828f89e2f7b43e66079029e9d326119420bf22

  • SHA512

    0e422673be681495cae2156c573905e3950b4b86408eca06dc06bfa42b652f1038a4233e6a33f3bbc5bcfeba361c6cf22f0457fbadc1d3beb5dd6faff90e4b0b

  • SSDEEP

    1536:W7ZDpApYbWjIoPyPoLzV7c6ShWfxRfxMlf:6DWpLf7fWlf

Score
9/10

Malware Config

Signatures

  • Renames multiple (3158) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\d512e5a1c13018ddbc17313f30828f89e2f7b43e66079029e9d326119420bf22N.exe
    "C:\Users\Admin\AppData\Local\Temp\d512e5a1c13018ddbc17313f30828f89e2f7b43e66079029e9d326119420bf22N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2520

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

    Filesize

    85KB

    MD5

    67004cbbe12be9b7e6bd73881697ad04

    SHA1

    6ca93a387e9e9e0c520a435b5549afa5b57c4bd8

    SHA256

    318294c83f26d100f4b2c35fe93b5a43cadd990ababa8412bba01d703a1f30c1

    SHA512

    ebf3d3fe06fd803022383be247a8fca306480a47fe3e2d9e4612709a2f3309e019e4746e83780705f65d0e7130e2e5a99299673ef044707c13db28df7dd5f501

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    94KB

    MD5

    87b68bf96926d7eea2eaa60ee38a75a5

    SHA1

    aa6a90f9245f7fdd18a527b3eb716e50b0a25560

    SHA256

    234fae43f4dd41fd2c5ec18721f2508d0461f0b0cadf11dce771439534f32fab

    SHA512

    b52d3bdee9e3e46f910a89d79bc921df9d94e40b8606c132aaf4ba877ad85688125ebaae31bb19df1dbe5694da6d169ed4dda9d5a741c0a45663b3856732a4ee