Analysis

  • max time kernel
    119s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    18-10-2024 03:58

General

  • Target

    42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe

  • Size

    59KB

  • MD5

    fb6b7e82fedb8c4296e87659acb24860

  • SHA1

    f73f041a381233a6800c3c38c15245b6d3ca065b

  • SHA256

    42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333

  • SHA512

    b53fdb7c66a9e9e6e4458c51152448aa5cb459866f1831b365a57bf6a2221b53e8e7e93ae21bf0c84320597c60e55506fa288d4708170724d2efff1999249808

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/ti0oj1O4iY:V7Zf/FAxTWoJJ7TTQoQ/IE

Malware Config

Signatures

  • Renames multiple (3278) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe
    "C:\Users\Admin\AppData\Local\Temp\42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2660

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

    Filesize

    59KB

    MD5

    83e405022634d5953b27c7709327beb2

    SHA1

    3622055489ccdc159da5299f6122f6bbc6cc07d1

    SHA256

    066fe29a528f5dcb7972c8f9adb627ed9f85d888852dc6c8aad0838bd94453d4

    SHA512

    896006cbdc3188b3e04e385a4bdaa5f321253675060c75c60c1ecfb3bea7f3fb94dc9d828f3407eb19a4a14f44c1607634eb293d2fddbc237e589cda92810751

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    68KB

    MD5

    d0f06ee91fd5fe60b582d559ba5925df

    SHA1

    133e99fcca3a8072c2d16cdf1989ffab3790f76d

    SHA256

    35b8f9907184cd6a9c6862810c77dc055f001d5c18e49db6067aad4beb661e81

    SHA512

    7275fb17692c65208d31f33f34be48a0d1f3f21fd7b334c68a81a1124c016e58a9aea24094730c4d5d15ef889661ba1de22178db15b3a09a79ab3a21abaca05b

  • memory/2660-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2660-74-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB