Overview

overview

9

Static

static

5

bc7bdc8e51...fN.exe

windows7-x64

9

bc7bdc8e51...fN.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    120s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30/09/2024, 13:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    bc7bdc8e51ec4d42661d5e268e4f39856d8c27600d5a4694da173e713fe2c88fN.exe

  • Size

    30KB

  • MD5

    8f3353c1f4af04f5fe6ff6488d726470

  • SHA1

    3268118e5dfbad4d130426385003a731f120c931

  • SHA256

    bc7bdc8e51ec4d42661d5e268e4f39856d8c27600d5a4694da173e713fe2c88f

  • SHA512

    2c9edab430087c91d394d7b6d3a1822812a02c4bc18e5245c1004f09fc1ea72b5d29b3cde88b42af4abbb14791639d5924d151593997c45c10918272d4d28a69

  • SSDEEP

    768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9ZJ3Rl:CTW7JJ7TzJT

Score
9/10
discoveryransomwareupx

Malware Config

Signatures

  • Renames multiple (3277) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\bc7bdc8e51ec4d42661d5e268e4f39856d8c27600d5a4694da173e713fe2c88fN.exe
    "C:\Users\Admin\AppData\Local\Temp\bc7bdc8e51ec4d42661d5e268e4f39856d8c27600d5a4694da173e713fe2c88fN.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2500

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-3533259084-2542256011-65585152-1000\desktop.ini.tmp
          Filesize

          30KB

          MD5

          956393ef12e2502c81dbd00061e7bd54

          SHA1

          b91deb091a5ded3cea192d9253a3b47a4930eeea

          SHA256

          b131a622c4ace9fba9005cefcbe3159c02d2ebfe0f7937aa5effce0f30bc66f5

          SHA512

          7ef755d4225008519f153f264d33e25905994ae5ac84a6abba489d468294ff84359c3262a6f88063dd59cb840286f409c7b2319008e8b857bdeabbcba3245f3e

          Download Submit

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
          Filesize

          39KB

          MD5

          afc18b5458fd7a40f18f0e30e1507375

          SHA1

          189981a67f79dee14563fff642435ae9fb4921a9

          SHA256

          0a23bbdd416083b8a4a33757d0612d8a2d63da7a201358731e7da8d0738cfdb3

          SHA512

          7c2bbf862f54e20925fb8b0221a9f0efcaac51f624c556f364636e505465adb720df55eaf8bb7365d380fedd7c57564fdae88f277afafc30e96f9df8f8d10687

          Download Submit

        • memory/2500-0-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

          Download

        • memory/2500-70-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

          Download