Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20-10-2024 00:42

General

  • Target

    1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe

  • Size

    43KB

  • MD5

    782ad2e90988c8eebd513cacd783ad40

  • SHA1

    bc6ead544f4650ea6cd0c988d3a668d053d90acf

  • SHA256

    1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbce

  • SHA512

    ab132af80d7ecd94c511a1c8fd914d8f42ed5d1c61a748d6bea2f244c7d34c777ec5aad85cb9d053b0603fb17f0f01c6e2585df99e9445121f4cbc4a4a5a797d

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATBZ:V7Zf/FAxTWoJJZENTBZ

Malware Config

Signatures

  • Renames multiple (3896) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe
    "C:\Users\Admin\AppData\Local\Temp\1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2132

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini.tmp

    Filesize

    43KB

    MD5

    df4b312f37c9891e101b89466048b1cb

    SHA1

    e5cdc0a19093a64c6bf94cc0813679d3f5541338

    SHA256

    cc4c759b4651598fd80d0d9ed687462ea3cfb496ef2409fd60967db4f0ea77f2

    SHA512

    074811c97fc708f46bd56e4eb8cdcebf71037f9286429c558c3fc35c089e92fef4f8f69198ae21d743e24a55652a563b43784cc7af19ccabf3c7b7a41dcffb4d

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    52KB

    MD5

    76fc9e45c8cacace287ec240da7ab0d8

    SHA1

    040d62c7be20fb4db2eaa69ca0cd6c7de7366610

    SHA256

    fa8220319f7926c65ccd206fdd0ad6180f1b96b18b75cb82197862b23e5707d1

    SHA512

    15275af14af3efca32379017c2e04476de7d2eca743a057377140ba4ed58b94ec6d476993680ebe1f7d614e8b4561b544f451666d21fe5dec470050988224633

  • memory/2132-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2132-70-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB