Overview

overview

9

Static

static

5

09028adc5d...0N.exe

windows7-x64

9

09028adc5d...0N.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    120s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05/10/2024, 16:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    09028adc5dc55946fa6533acc6a2be201397f7d389d8ca0e8f87d567dde48b90N.exe

  • Size

    80KB

  • MD5

    b34bcf3fb6d06efb396c91cac8e49740

  • SHA1

    c50b37b49d292e291b2c7fe1fc33efa3812e1b75

  • SHA256

    09028adc5dc55946fa6533acc6a2be201397f7d389d8ca0e8f87d567dde48b90

  • SHA512

    a925824bf5fbe1ffbb306b55c9080c3a207448fe52fdb34f037c75de888bbabb68ffbb820ed593d026ca8005bb15ab33d6e6e59cdc4ec2e7d58205e27a829d5a

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKK0SjHm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/S/:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Qj

Score
9/10
discoveryransomwareupx

Malware Config

Signatures

  • Renames multiple (3215) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\09028adc5dc55946fa6533acc6a2be201397f7d389d8ca0e8f87d567dde48b90N.exe
    "C:\Users\Admin\AppData\Local\Temp\09028adc5dc55946fa6533acc6a2be201397f7d389d8ca0e8f87d567dde48b90N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2524

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp
          Filesize

          81KB

          MD5

          0a6dffa597153c1980a2cf4b75007c89

          SHA1

          06408314f99119b4cd6a30923c74f3aca68a0415

          SHA256

          a655ad32458bedb25bbec7423a99c665b79958837c1f480aa6f1f43100d51076

          SHA512

          fa95d1f2a70c7251a47c1684453fb9c640c7ac0542bac218a8491a4079ecdb88cfa93e699271e3cde3b3f39a7c1a0cd6d7c4b18fddc2733cbdd75531c8274a65

          Download Submit

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
          Filesize

          89KB

          MD5

          a205bc5af23dc4f228fabf8a255128f1

          SHA1

          1e9a8025264d289ae8fb6d3e0fbd09a43565b24d

          SHA256

          d12f16f31d104a14d6f853dd3e38b38b4366b23dfae3037791af2ffbaa05a8b2

          SHA512

          f31ddb2c5b3ac7e4562f78cc68b259a253f0b184fabf70b9b7ca2b3167e5e6442dffe825a2d48f0bdf052e5cbd7281eb89e3bd078cf9a7427226a86b0009e994

          Download Submit

        • memory/2524-0-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

          Download

        • memory/2524-74-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

          Download