Overview

overview

9

Static

static

5

b99871f9d3...0N.exe

windows7-x64

9

b99871f9d3...0N.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12-10-2024 13:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe

  • Size

    1.1MB

  • MD5

    833790d4fc106fecfc6bc3a20cb12f00

  • SHA1

    f314a7c351fca192e82dd54ea811c2f48b4a642d

  • SHA256

    b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90

  • SHA512

    e8ed386de066e3f4e989d96da0083ecf68fef96c9eab175778cbbc0d6724257cca839e7c5ddae52c159e09b2f0151290d7747aa89f961c256c3bd7fb6d957533

  • SSDEEP

    12288:HRxUzukXdE9qxj33vGPL5k4Omwh4UC1kCT9Y7tPMR:nUzukXdE9qxH4OPh4UC1kCT9u1K

Score
9/10
discoveryransomwareupx

Malware Config

Signatures

  • Renames multiple (1027) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
    "C:\Users\Admin\AppData\Local\Temp\b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2408

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp
    Filesize

    1.1MB

    MD5

    009387eb8de562bf20ae6afed4023fc6

    SHA1

    488c1ea22a0cb017ef53216f373eacf31608a400

    SHA256

    7aaca3c2e46e2a06e595ef0272e7ca9a7fa177c4968bf046f2872dd6171c891e

    SHA512

    ad8a2b3fab1f6a980ccc34bbcd6aa814d929da60ef8c92611c61b707d72549e20a7310dfaeb91dcd9d6f0155dca296fc82a3c0559584426c1be5f00f916c20b4

    Download Submit

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
    Filesize

    1.1MB

    MD5

    dff8da48b684941fae5fc74173e4ff6f

    SHA1

    d93b1e5fe068515015369897b4738bf1411440dd

    SHA256

    d08650c5ecbf820c1119461e744705cccb2d0533427b4b55b4cba5c592e66a81

    SHA512

    a62a2733bc690348d22bb19d2ebabb1e72ba1d9125ee4ae6f759c3bc06c48e9c7c8a3efebd326f22f42313e2a3462f96680fe9281db1c07f4fda46dcd58ee334

    Download Submit

  • memory/2408-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2408-64-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download