Analysis

  • max time kernel
    120s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/10/2024, 05:26

General

  • Target

    d287f9c0cf064c21399042a6b73c4d6156e154df4ec89608acda7b8294df8677N.exe

  • Size

    58KB

  • MD5

    e4aa16f325eb4d923eea20f719dc97e0

  • SHA1

    61ec8c2c2f11b0c624397d2fa9a987e51375ce10

  • SHA256

    d287f9c0cf064c21399042a6b73c4d6156e154df4ec89608acda7b8294df8677

  • SHA512

    a4b081fccf9cac23447331be39d595d1c30f3b2703ee7ab6cd28781416af6175999b2f0e198b8dd8edff4042f91662973e7a0565199d9bf0f55b61325dbafc2e

  • SSDEEP

    384:yBs7Br5xjL8AgA71Fbhv/Fzzwz72Jwuq2JwuR0U0I0gQemyq8gCgQemyq8gvaymt:/7BlpQpARFbhNIiJwsJwwnZGynyQNhl4

Score
9/10

Malware Config

Signatures

  • Renames multiple (4614) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\d287f9c0cf064c21399042a6b73c4d6156e154df4ec89608acda7b8294df8677N.exe
    "C:\Users\Admin\AppData\Local\Temp\d287f9c0cf064c21399042a6b73c4d6156e154df4ec89608acda7b8294df8677N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:872

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2878641211-696417878-3864914810-1000\desktop.ini.tmp

    Filesize

    59KB

    MD5

    6acc8ce53a8c9ac3fbf0872ba6d61758

    SHA1

    0d8f690b75f425e980bd1b05ec907bd7a903c9de

    SHA256

    6ed5b2ac1df5e3315dd2f3e89ad159d4f957c0bbed8611691fce72505dbe45f8

    SHA512

    2cf62c7171caa9c901c3e0f75c0e1805defa4c1adc7e4d25b73fef719533ade8a01562f75ae4a58b21bd772c23a339d894ee8bb5c73cc7d8b25d0c3e3f1637bd

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    158KB

    MD5

    528fd5d2d9d5489e53a070583d7a78cb

    SHA1

    f99f96bb809e4c8089961630c4706a1ad9fa7373

    SHA256

    7e02461443f9043d42c8e63013794dd579d4904a9a72da23fa0ed3cb9080bba3

    SHA512

    ba66d90e8753437f76a1cdbbe1483c86c3d403c34ebfaa312406aec0f0bc537eeecd4db706897dccb745e76083d754bb09b06356972ac8b7f56b21e7199c7c6d

  • memory/872-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/872-786-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB