Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/10/2024, 19:46

General

  • Target

    648274553880069e1e1b55e57c2b8763ec4d4bb5428be778747af8ae1837c7cb.exe

  • Size

    55KB

  • MD5

    4ada473504405ea42506376eb1477fb0

  • SHA1

    f9ad0dc3658bdb2070fa5e5c482ac7c48402eede

  • SHA256

    648274553880069e1e1b55e57c2b8763ec4d4bb5428be778747af8ae1837c7cb

  • SHA512

    d2ac51f10258ae93e7e7be7d70ee203d8459961cc75939f254108e8a069ccdd2b89822c099e047fe300d850dc88bbd21d65d7d0fc1e303b6cbb3d90f786817c1

  • SSDEEP

    1536:W7ZppApBULcfpHLcfpyD3tHtS+AtS+BKy:6pWpBwchcwD3tuKy

Score
9/10

Malware Config

Signatures

  • Renames multiple (5193) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\648274553880069e1e1b55e57c2b8763ec4d4bb5428be778747af8ae1837c7cb.exe
    "C:\Users\Admin\AppData\Local\Temp\648274553880069e1e1b55e57c2b8763ec4d4bb5428be778747af8ae1837c7cb.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1656

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

          Filesize

          56KB

          MD5

          0ce401656224e91fdfcb5810c9e2d083

          SHA1

          1c28e69a1d854826a4bacf511f39955724b7ecfd

          SHA256

          dd172313137dc68ef6fb675e2f0f09eba46eb2c15dacb3f16c86dc0144c7b230

          SHA512

          c20bf1fbb66c148439cc57bf1b31056b01c9e09bb128f3ecc9d456a7f1fbf26788cf442b9189b9f83f9ee1f500d9565cfe0b9cc3fc67adcfbcd1d25162bf65ff

        • C:\Program Files\7-Zip\7-zip.dll.tmp

          Filesize

          155KB

          MD5

          223d7e89b4dbc0b6627a0e3a196ef078

          SHA1

          55a18b61100d5556c4fafcb7ca68d54a27a37096

          SHA256

          a9e03c74af713ff040d42fa08bb28a0a628464c344206216723e36c93e8ad1d8

          SHA512

          05e9fe884cef95d3afde3f9d25f1a9132e6c6adbf118d67faeb9dfecc7e045c020d768073dc26cf365a9bb334a1a72a833543f8b604e1473928ff66dc64c4aff