Analysis

  • max time kernel
    149s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    05/10/2024, 19:46

General

  • Target

    648274553880069e1e1b55e57c2b8763ec4d4bb5428be778747af8ae1837c7cb.exe

  • Size

    55KB

  • MD5

    4ada473504405ea42506376eb1477fb0

  • SHA1

    f9ad0dc3658bdb2070fa5e5c482ac7c48402eede

  • SHA256

    648274553880069e1e1b55e57c2b8763ec4d4bb5428be778747af8ae1837c7cb

  • SHA512

    d2ac51f10258ae93e7e7be7d70ee203d8459961cc75939f254108e8a069ccdd2b89822c099e047fe300d850dc88bbd21d65d7d0fc1e303b6cbb3d90f786817c1

  • SSDEEP

    1536:W7ZppApBULcfpHLcfpyD3tHtS+AtS+BKy:6pWpBwchcwD3tuKy

Score
9/10

Malware Config

Signatures

  • Renames multiple (3731) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\648274553880069e1e1b55e57c2b8763ec4d4bb5428be778747af8ae1837c7cb.exe
    "C:\Users\Admin\AppData\Local\Temp\648274553880069e1e1b55e57c2b8763ec4d4bb5428be778747af8ae1837c7cb.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2488

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

          Filesize

          56KB

          MD5

          3ff1c54e8b1c195740ccb30a2eee4f2c

          SHA1

          b24307d77274a18e77b0b7e8bf6726ea431df254

          SHA256

          2d6cd341813c0cbc1a58ac9a83e6c25b0a375c125d366ffac7eeef47dac8d5db

          SHA512

          d03c94cfdc07e3a0e02ec0fb2781a335de2e65b1af924b93c01ca39b38abed4bdb608861bc73d48eea66c72610924ea1d7bf10c79961e5a5415dd42b5d2f5511

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

          Filesize

          65KB

          MD5

          247d39183f5f8cc8cca712b615712dfa

          SHA1

          bee054bbfbc60910e754ae70cd0679a7e4b1e5b4

          SHA256

          f19411b95e9fa7075b95e92a07f12164809069f092761dc94fbc52373cc48b1a

          SHA512

          9a02b68cfdfb95f37040f48a8734d579b4d6f26ed88d3b59f49ec7ed2031f53e2b08405d25b2f3a9599749723401c4ea42072a25ad78723523830e5940bedd2b