Analysis

  • max time kernel
    119s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06/10/2024, 09:19

General

  • Target

    0f1238379c7570ee26f0bd05c5c09a8a30ac3fc7bcac940fc92dbdfdb5993f2aN.exe

  • Size

    58KB

  • MD5

    66517b06db1a72b3c056ed725bbd2590

  • SHA1

    37a0306dea9966d9d10333f5f0e0147693756fe6

  • SHA256

    0f1238379c7570ee26f0bd05c5c09a8a30ac3fc7bcac940fc92dbdfdb5993f2a

  • SHA512

    7b4de71863152895152b31e82dafa23dedd8256309dcf1a44d82c8124082796975286ed220428c7183d56ae65d09f2feedc88950e072fc1f0647d4dd53e7088d

  • SSDEEP

    768:/7BlpQpARFbhvEXBwzEXBwLtAc7Fc7m9n:/7ZQpApHom9n

Score
9/10

Malware Config

Signatures

  • Renames multiple (3277) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0f1238379c7570ee26f0bd05c5c09a8a30ac3fc7bcac940fc92dbdfdb5993f2aN.exe
    "C:\Users\Admin\AppData\Local\Temp\0f1238379c7570ee26f0bd05c5c09a8a30ac3fc7bcac940fc92dbdfdb5993f2aN.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3044

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini.tmp

          Filesize

          58KB

          MD5

          b0e16d24391c56e904445a55ef9ec4cd

          SHA1

          4850382f59d360119347003e31888fcd822e2845

          SHA256

          dc4de4453aaa76e488c8e90ed2fe8ecb713d88b2efdecf85d78abba02eef775e

          SHA512

          1f83884b849890f77b3eeed9c70f65b3f6e5621666f269593867d7e7ec282869c8cc3eb8f7dbdd680b44a8104aae0c8856d3100b1a1f90a60cb9a5bb705c0750

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

          Filesize

          67KB

          MD5

          1b76d9c3459676144ba8cf049949798f

          SHA1

          cf6dc76da8f7e9dc8c434a030476da3de929efca

          SHA256

          d17bc4db2ca0cf8ce61fa46381bd686c24a8b89f9c133acdb1a9dde86558e852

          SHA512

          e6fe1e35d4e15ee216f995e8cda45ad4b3c4fab4fa2b6efa3d95aa9ee42b0558c8a951d3d9b71d2be5445cb6dd5694d822e80de61d0c8d4ab450cf29f7d03b3c

        • memory/3044-0-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/3044-74-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB