Analysis

  • max time kernel
    120s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    05/10/2024, 19:26

General

  • Target

    e2884084ff248b23c142e2ee2599b92a71547f53c3e797d50fa8dcad87b90bc2N.exe

  • Size

    86KB

  • MD5

    8cd8f6991f8daec23107550ae4be4350

  • SHA1

    4e09d8a520e7b3a6b5a68b7195bce8f93253e9d6

  • SHA256

    e2884084ff248b23c142e2ee2599b92a71547f53c3e797d50fa8dcad87b90bc2

  • SHA512

    995c0803daa723f14a198eacf50d90448f9e4515d6d134e820c14078ad5e2d0fef7ce83d2a25e4a2532fb2bce8b32f2b1a457bb2dc6e178f563e8ebb60ce2b1f

  • SSDEEP

    1536:V7Zf/FAxTWoJJ7TPUfTW7JJ7TPUx7C5C7C5v:fny1zUozUk

Malware Config

Signatures

  • Renames multiple (2842) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e2884084ff248b23c142e2ee2599b92a71547f53c3e797d50fa8dcad87b90bc2N.exe
    "C:\Users\Admin\AppData\Local\Temp\e2884084ff248b23c142e2ee2599b92a71547f53c3e797d50fa8dcad87b90bc2N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2232

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

          Filesize

          86KB

          MD5

          3a35879de6c0c5a72635ae2435e21be9

          SHA1

          1ad81a7e6d9f71aac8fedffddf01e7787a2d109e

          SHA256

          fd6103defdc3c65c623831eb4ad23bc02812e250b07ce0b3396eb693930094d1

          SHA512

          f966315a195ab2ed255da98c581732ea6b1987c8d803dc7e4f877e387cb75cab0c7f51f93a414a28e0845a412ed2aadcf90d870e868563fdfa3bf17e341d676b

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

          Filesize

          95KB

          MD5

          8adbf3bf257f8f4bae8ef0673616d185

          SHA1

          70786c6efd818327d90680637035831647197a19

          SHA256

          c22499c46de6e906098f6e8d1e6433141628e1ba5e726f8adb8c0603b54bad04

          SHA512

          608b24b8754d5b076ca8f6c1a820f1267d0b82a2ee245d959d28bcee2f1e114db761f6f228b8c23b73e4379bc4cea17aa0d3d8114daf9457bfe9f0b94ea256a3

        • memory/2232-0-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/2232-70-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB