Analysis

  • max time kernel
    150s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/10/2024, 19:39

General

  • Target

    b79e8a82575a55cdaa2d79d39a032f72a8a5921d4850594e993bc6282a8bc130.exe

  • Size

    70KB

  • MD5

    7dfafe071602387c813a13dbc25bf816

  • SHA1

    723bfdd09ca90c332570e518576559300199ac9e

  • SHA256

    b79e8a82575a55cdaa2d79d39a032f72a8a5921d4850594e993bc6282a8bc130

  • SHA512

    1977e11ad036637dc5e80db16634240445369d58c01a7688118044f80176e5f7fac3f85625700d997640fef01a6aafdf34a0e0b53830f79cc45aeb6a93d64325

  • SSDEEP

    1536:CTWn1++PJHJXA/OsIZfzc3/Q8zxY5a8XHwH1:KQSox5a8s

Malware Config

Signatures

  • Renames multiple (5020) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b79e8a82575a55cdaa2d79d39a032f72a8a5921d4850594e993bc6282a8bc130.exe
    "C:\Users\Admin\AppData\Local\Temp\b79e8a82575a55cdaa2d79d39a032f72a8a5921d4850594e993bc6282a8bc130.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3084

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

          Filesize

          70KB

          MD5

          da4978616b6183bd778c9179eab817ed

          SHA1

          1021ad60dd82c392ff6209400c6086f69b6a08d8

          SHA256

          6b8c604ce31c4376255670525d1f15a0efd1898c60cc9a5d901e35ad7a44a1d1

          SHA512

          4af9c1dc443df6327f3b92c6dee75cea7646758027ef4e3c7d6617d667a766e12dc154dd4a2646bafd1f0a48cbbeca46d56bdce541dd8d6ac829775b2e8b68b7

        • C:\Program Files\7-Zip\7-zip.dll.tmp

          Filesize

          169KB

          MD5

          88d80bda0eee58e7faf8a19f9631e593

          SHA1

          370bb9eb5de704c6db0e2e13ca8f0618ae6677b7

          SHA256

          5ad45fb58442b21ef789aab06f99a6d477bc004e93f393eda15e067b716cdde4

          SHA512

          b61a5583c1fbce50fbca6883d8b03a54cee5d309a09dea673c9d04acd921612dd02bb4dbee529defbbc45e5d582787cbbd17dbdab5697cb6d5d29f2d63857c28

        • memory/3084-0-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

        • memory/3084-854-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB