Analysis

  • max time kernel
    120s
  • max time network
    105s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-10-2024 03:58

General

  • Target

    42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe

  • Size

    59KB

  • MD5

    fb6b7e82fedb8c4296e87659acb24860

  • SHA1

    f73f041a381233a6800c3c38c15245b6d3ca065b

  • SHA256

    42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333

  • SHA512

    b53fdb7c66a9e9e6e4458c51152448aa5cb459866f1831b365a57bf6a2221b53e8e7e93ae21bf0c84320597c60e55506fa288d4708170724d2efff1999249808

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/ti0oj1O4iY:V7Zf/FAxTWoJJ7TTQoQ/IE

Malware Config

Signatures

  • Renames multiple (4623) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe
    "C:\Users\Admin\AppData\Local\Temp\42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3680

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1045960512-3948844814-3059691613-1000\desktop.ini.tmp

    Filesize

    59KB

    MD5

    22e2002c189db21eba2abec5c2bae1b2

    SHA1

    c543fb468955808c6ad84f070b666cde4439c7a7

    SHA256

    bb6daca08b90f8ab1bdc4d853396d5c771b6ba5d385647d195af81add08047ba

    SHA512

    b71245252ccc526631a3a249ed54d4821f975c804e3c1f1c7daa329617b643b47499a316c55a7f7b0dd6c204c16389bf43db55429f589c3d86bd1bebd16d1f03

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    158KB

    MD5

    0293c1fbff4ce48d773f170b9c1e4056

    SHA1

    67e68e5f855a9009e88c39a20a4e12097dedcfb5

    SHA256

    ba66eae5381edbaa7da5aafb9dbdeefd30e56b77fbff801142fb617dc1156a12

    SHA512

    9bf18e95e160f7e531e5c00a2024de3d559cfedaf49b450c0484efd734ea70f9cf63124f0d338399e60ff5f5db77340773424afa5b87b6839125d6bbd6a326f6

  • memory/3680-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3680-782-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB