Analysis

  • max time kernel
    120s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-10-2024 18:05

General

  • Target

    0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe

  • Size

    584KB

  • MD5

    e7be3031468930b44c6679487d4e97f0

  • SHA1

    0098d8ea27246df367ee815407ddad7279206a6a

  • SHA256

    0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9e

  • SHA512

    8a3e0cba2570bb9bcffc0c5f46494d0ea7419c5a9b050d91d72bb520bf8aa0d237a9a48620506746b4abed6dba8fda525f4f0b251891278fee87047b6440fcc1

  • SSDEEP

    1536:CTWciVRRNRROHrNOPLeMS+YanjU8YKLGPavsH5d6mFUejEdH1v6H1wH1I03pkTWd:hRrRgxOeORYX3FFodVv6VwVIu8X5y

Malware Config

Signatures

  • Renames multiple (2187) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe
    "C:\Users\Admin\AppData\Local\Temp\0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:4144

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2045521122-590294423-3465680274-1000\desktop.ini.tmp

    Filesize

    584KB

    MD5

    7c15f6650fdcd1d159c97a27d0f3c4e9

    SHA1

    5d1a0464f92e78ffa31c8298acdbeaf0bbebd160

    SHA256

    faa576d6562eebc739b5d742d7b9beaf387d8d1c56b8c0188f3d0aef8df37bcc

    SHA512

    cd7bd0260deab5a7366b9d4a82080af52ef585100d3d4a2da7a597ada8ec896a4898a3ab972e6c5f20b5586943da586075d0ff6b9c741b0103d4852127eddf22

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    683KB

    MD5

    9cbe8ada79bec375447111997b5889d6

    SHA1

    7ec10507d0152e4849fc70856c075138a9704270

    SHA256

    25e0d55573fec916e6be5fbbfd5826142726cdcceba2e8b304b2880d5526d797

    SHA512

    058dbcfafbe2738dbffc82c6b6d32ce61ab7148711111993663260120951f8e7cd943b4c44b7fc134ada6dd9690dd3810bcc6e6a4fa57cf86ef0d15133364bea

  • memory/4144-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/4144-429-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB