Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16-10-2024 18:25

General

  • Target

    103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe

  • Size

    54KB

  • MD5

    736feb30f912ec759602226c17822930

  • SHA1

    67b8f6a43b0af45ed9000877de00f1750f404fdb

  • SHA256

    103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcf

  • SHA512

    be25a8c7668a69a51d13baa9f66263e90975e2746dffb16ca85f633c15c1a52989358243a0078a8f1a1e546b80ed6799e9b9986c7d0de632f1a1615e97e6954c

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9Yo0NO6iJfo0NO6iJ+:V7Zf/FAxTWoJJ7T+mR

Malware Config

Signatures

  • Renames multiple (3672) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe
    "C:\Users\Admin\AppData\Local\Temp\103981cbb7016005c5e39411602c0642e2d5c669cf7dc6406e368ab716a27fcfN.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2848

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

    Filesize

    54KB

    MD5

    da7fa3da7183014e82875963e8b89dca

    SHA1

    246936d0e78f9dfe221895bc5b0cef9713d414fe

    SHA256

    7a3c61f2b9c3e3f001a9afd281a58bb4964b95c507d1e28e72cba8a3d1054e2d

    SHA512

    546ecb77c5d4ad6e1a31cc45e448c3a5c8276a1deb4d2bcad5b4dbf8dbcdee62cd9da2df204fa4651b35637c14ceac7702bcd106d9237f83606b07d140476690

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    63KB

    MD5

    fbe8b99cb86041224c49758cd78bc9a6

    SHA1

    1beee85fcd79adeffc3ca6bfea4b46ec23ae8c4f

    SHA256

    d9b62785199214ad1e67b63980dee12cc8a16bc36e9bfcc7aaf0057dde5b209d

    SHA512

    e71b289a707fe285102f4e71a01a3687a5bd9ef368b454691e2377aa670be176d547e49d5cf7a4e07c97ef0b45603af5a4b74524ac9ee64fe971800be9f10a43

  • memory/2848-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2848-74-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB