Analysis

  • max time kernel
    120s
  • max time network
    112s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/10/2024, 09:50

General

  • Target

    0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe

  • Size

    45KB

  • MD5

    b1c3a5e077547f6d533888d59f487e10

  • SHA1

    c6501eb4454933b1172d742a2d19e05765f6d21e

  • SHA256

    0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2e

  • SHA512

    d1a6bf331bd9855694f6212d7c9e9b12595296d5823a8d0493422a91f5bb8b7833d79a3ab2b89d0864ceb5f7b1c901b1e8c1a0f19bf8dae79cc1c50dea8f0f32

  • SSDEEP

    768:W7Blp+pARFbhBgnKLMWK9WKD2N2LSarSaC:W7Z+pAp2nKLRKIKqoLSarSaC

Score
9/10

Malware Config

Signatures

  • Renames multiple (4665) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe
    "C:\Users\Admin\AppData\Local\Temp\0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2000

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

          Filesize

          45KB

          MD5

          96c739801cd9ad224b51fa0137c69350

          SHA1

          f9808ac23bcda5d3b466010a5c91bfb8d619a4a0

          SHA256

          8efcf69d87f9e8998267985ddb47653db8b397d0d5938cb3c69be05b36829695

          SHA512

          5f7caf84a628fb8002a566d9020e2802af759f841536909af707be833c299ec9033c90777a03298b39e7fac20a7a135d4c7a278528ccb083ac693963aab8854d

        • C:\Program Files\7-Zip\7-zip.dll.tmp

          Filesize

          144KB

          MD5

          e604ea9c86b19df3987a7d5ad0215f60

          SHA1

          1752ec836d15886cf6b98f857a7f3dfa4a4e2729

          SHA256

          4605a8931e4c255560d136d2815b0bc548cf81a598ac9a90545e8c7e9ad85cf0

          SHA512

          7ae0c305cd09e930667c360e2d00353749c77f476d347442d9fc835fcdd2347b2d01133663db6bc3e06d55d2cb13a2fc8bc6a89265d83c93e5769cb8d6009de2