Overview

overview

9

Static

static

5

40323b0f9b...cN.exe

windows7-x64

9

40323b0f9b...cN.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    120s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05/10/2024, 23:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe

  • Size

    80KB

  • MD5

    7160e2721abf8568b2d9845c44035ae0

  • SHA1

    5c8e6528fe2c485db1b2611095cf29da5612a77f

  • SHA256

    40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97c

  • SHA512

    0d8a5208d26d5349f0e8b2b5bf0d1f959e3f487e29a74c1b29183b88550819210f9eb2aabc3ea7bc895e3153ff65e32cc8b63a42f8e052e3abbac631426687ab

  • SSDEEP

    1536:CTWn1++PJHJXA/OsIZfzc3/Q8wYeHNm5EvDxfIyKoIWbsHfySkT5GeCyi348oWGT:KQSodYeHNmkDxfIyKoIWbsHfySkT5Ge1

Score
9/10
discoveryransomwareupx

Malware Config

Signatures

  • Renames multiple (3197) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
    "C:\Users\Admin\AppData\Local\Temp\40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2216

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini.tmp
          Filesize

          81KB

          MD5

          1702a2db196c82297fde055ad9e0c9f1

          SHA1

          9292b5ce17c281d011092ec6184049051169c921

          SHA256

          ecec2ac7b6813563f72dcee20c2254764f1583442d8ab1b59a30c3aebb8c53ea

          SHA512

          5aec74dd797d60013113a57c41cf28528ead64ebab74953e14954c03b4e1a5b3104a97d9ce0913d524510b5b43b65dc933a67dc8e2c89414df01c4d235a0fd45

          Download Submit

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
          Filesize

          90KB

          MD5

          3f2088838fbe415c773d97348f2dadd6

          SHA1

          bea8a2e6e68cc90062786be7eaedbb9483b873c2

          SHA256

          c481e375d2d6b974d3b0ddbf099bdfc646030300a968fb2529250ed38a717cad

          SHA512

          91491d4bd8a061062f228c29efe4fdaa2786e36594b5620c061dced6a271a8f3abade5ffa58de47fb3cc2e86681f1b0a0a2893b9950712be85c2ec64ffd7284c

          Download Submit

        • memory/2216-0-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

          Download

        • memory/2216-75-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

          Download