Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16-10-2024 17:09

General

  • Target

    db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe

  • Size

    53KB

  • MD5

    190e084a8a0725a34603fd2bb32fcf90

  • SHA1

    44b2a02367142703fd64f65c2adac46904d11667

  • SHA256

    db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0a

  • SHA512

    abb99d507b62365ddb64122b01989895a0975511ac7b5210649a90d959fc1e448d9a70703bc01e0d585fb5e6092d36b5e98bd212bbcb6a9313505011e114dda7

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9V:V7Zf/FAxTWoJJ7Tj

Malware Config

Signatures

  • Renames multiple (3733) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe
    "C:\Users\Admin\AppData\Local\Temp\db002f688f4906da3e9b40524fb18dc5a9924f310f3a5846b6fa9a91d68dfe0aN.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3064

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini.tmp

    Filesize

    53KB

    MD5

    c88dd2e72d67d9a156dc26050842e580

    SHA1

    28a0c56ff52b187977a6932c7a34ae9ff33b0842

    SHA256

    f7d483f5b59c6de3905d2f4e4b14af2fb5665351b3078314399042ca91be51b7

    SHA512

    d5d9f41025b4cee1db758d028eed85c10ebc2fffcb460788a2025f9def4259c0d0d3edd526fc8193de621fb6c53a8dba10976577da590b7e19d93a08617f063f

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    62KB

    MD5

    0a3c3a5cdd23ef962b35c14b94587c90

    SHA1

    7581c2b65ad2592e33ba6c3aa648adadac65e7f5

    SHA256

    3fecdd7b77cd273fafa8f2def28e4f5e9f542262af3415fb228c4759ae4eb429

    SHA512

    6df3d1767c2ff825498de427f40e35b5b6224a1f58678a6c1bf687867e2c0d6c775b48a63773cc0c39ccdee7f57f5239e1cfe6cbd7d4ab996544820aee2c30f6

  • memory/3064-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3064-70-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB