Analysis

  • max time kernel
    150s
  • max time network
    106s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240910-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/10/2024, 19:26

General

  • Target

    c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe

  • Size

    42KB

  • MD5

    d8315bf38f859f5b36ccc8a0765e67b0

  • SHA1

    3747e5fbb5af9e9c135af3690adf6a98ff42f403

  • SHA256

    c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347

  • SHA512

    70b5754b5738e81d0bc3b3b7a4e4d3023a4bd729c5b319510b0a3d792b622b4414762263bb2c9e11780c18349b62eb42b09955655a97219e619e05468b2cfca8

  • SSDEEP

    384:GBt7Br5xjL9A7AgA71Fbhvnqj7jU7ubTAgpbuvx10AaIdKB7ubTAgpbuvx10AaIr:W7BlphA7pARFbhL801VvM801Vvv7I+J

Score
9/10

Malware Config

Signatures

  • Renames multiple (5005) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe
    "C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:4900

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-2629364133-3182087385-364449604-1000\desktop.ini.tmp

          Filesize

          43KB

          MD5

          44cad91a39dc07c677dbb569238a17b5

          SHA1

          877053e3f63219b4a2c9209b15ccf9fe28bcadf5

          SHA256

          3a9ce9cf3dcd6235ba26243caa89640ae35cbeb34d04afaaefe234e5c7e53486

          SHA512

          4e58fe042b6d5461aec9e716489855010e8bfe140e6a32d76050335024665822707aff72a4d26a645e89afa67f8fe1c5210a5a33aaf52d65263d3af095ff3e0f

        • C:\Program Files\7-Zip\7-zip.dll.tmp

          Filesize

          141KB

          MD5

          9f31d93db646e367ada1bd510f03a836

          SHA1

          928df1cea3e3808c01b0f29be1795443acc1fc7f

          SHA256

          193ab58fabf732b77fe992cc04a929da9df375b3bfcf3ac1b67fb9285e06f6a0

          SHA512

          f4260e2c1b8b5e72e3069acf1edbb232a7da355adc389517780b04b9ddb71b48fa9e1f35594ac45a6bb0a23bf31b265201c3619c584b8d0f8aa25fbf166c6f2a