Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/10/2024, 19:38

General

  • Target

    27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe

  • Size

    90KB

  • MD5

    4967679a3813496c0dc3752f310dcde9

  • SHA1

    23f41a02864f3e4227b175bcc5de00be48cfd744

  • SHA256

    27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0

  • SHA512

    1f24a0027aefa6309a6162789ac0130063d3ed3398e381cce33f7030604c886d1427b0c1126e3adb592293e16cc8bc4ade95697f193de4396d1f4ee061fc7276

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxY5Kw1qS:fnyiQSox5Kw1

Malware Config

Signatures

  • Renames multiple (5163) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe
    "C:\Users\Admin\AppData\Local\Temp\27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3152

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

          Filesize

          91KB

          MD5

          e7a4479703f32dd2b84fbd350306dabb

          SHA1

          73c0579c065f5a71a0b3db8e9e38f54c2eb90057

          SHA256

          3d6d68c58b6810e870591f12d7e5ac1292fc68a93f3c3a27ce92c7570bf9447e

          SHA512

          a1b3310b84f5d8d10545b5eaae17ff177c4f32a7c95435df50754c98292609b1dbd67898569073f96c468085aa877bcf4e5173e690ed31c98ab89c0c98d34eb9

        • C:\Program Files\7-Zip\7-zip.dll.tmp

          Filesize

          189KB

          MD5

          1ce59150b56936145681fc60e30f3395

          SHA1

          0c5f40bdd344420df6e1d839ed27b66fc61c8c45

          SHA256

          797cadb1fc66d1c29fe2e7e74bf16b88f95e9059a955583f832429baf96771b6

          SHA512

          6b873508ee74c9a38df113a865ea7fb326d3540406d471f53d58a73445787359a7b9416a1a43272a429731af6d95c092f021bd46dc7889838377fb340cd81701

        • memory/3152-0-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/3152-908-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB