Analysis

  • max time kernel
    120s
  • max time network
    105s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-10-2024 18:13

General

  • Target

    9f2d5a0d6421d64e55737198ae46ec0707abd42db72e43948f999d09f3ba109bN.exe

  • Size

    41KB

  • MD5

    55c6ff2e65c4773cf5db8c8b05f8c9d0

  • SHA1

    0e3d3b2eafc6711226448fdbf05493ae26474cc5

  • SHA256

    9f2d5a0d6421d64e55737198ae46ec0707abd42db72e43948f999d09f3ba109b

  • SHA512

    6cd20f51e6da8eab60fd341f7a5ab9f68416f6023cbb1bde3166bfff99bc6ef3cf951fb491181a4d405f38715b80dcd5d788926bd0f6ed4720732288c19df660

  • SSDEEP

    768:kBT37CPKK1EXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKeKiwlL:CTWciVRRNRRI7

Malware Config

Signatures

  • Renames multiple (4647) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\9f2d5a0d6421d64e55737198ae46ec0707abd42db72e43948f999d09f3ba109bN.exe
    "C:\Users\Admin\AppData\Local\Temp\9f2d5a0d6421d64e55737198ae46ec0707abd42db72e43948f999d09f3ba109bN.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:5028

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-4089630652-1596403869-279772308-1000\desktop.ini.tmp

    Filesize

    41KB

    MD5

    04e12070209cfcd77a4eed42dbfd7c7f

    SHA1

    c0d1f9f3f818a37b653e858f2fadfa89ff83b2da

    SHA256

    1226efc1181137cf2f5bd6fe6458fa0540c8fea996c9fcf7f43b4f56085ed8a8

    SHA512

    52f7216ac689337eac5cb6b70d37e93e26ad93e0d781a932c477ee7131c7fb0476dbaf7c6e2d6142b4b90a860ae850a295fd32d58332513e57281395bb5f412c

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    140KB

    MD5

    e58064c8235bbb01b92cec587019838c

    SHA1

    4a018f84cdf2de5824bb474755b8d7e67d0115ab

    SHA256

    379013577d68485d3fab34a9d3f3435e2ac83b5d64ffd952d7643189b01bb1f0

    SHA512

    21a95f73af0429aae3b62753bb072156b057de54d10eca2a063145c9bbebb2f796ed057d333eb7d51bacb5b8611a3dab6164081b01262278afcf747b9ebc1a98

  • memory/5028-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/5028-785-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB