Analysis

  • max time kernel
    150s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    20-10-2024 01:36

General

  • Target

    b815acf7a5c98bbb90373602f939d6683f22d23728070b53e11ef0f26749964c.exe

  • Size

    52KB

  • MD5

    ae1a89352084bcac1bbf4715a9b6ad95

  • SHA1

    e1441f378036a05ea10e1a052a97e3a468380cba

  • SHA256

    b815acf7a5c98bbb90373602f939d6683f22d23728070b53e11ef0f26749964c

  • SHA512

    a65a9be904bd44a3db322823766bf11a449d58f4fc74ccf2524685d55377d781b1fc67090c5fe50b67e221e53c11fab86f9881dc1543a63a32495e7484944bcc

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9X:V7Zf/FAxTWoJJ7Td

Malware Config

Signatures

  • Renames multiple (3701) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b815acf7a5c98bbb90373602f939d6683f22d23728070b53e11ef0f26749964c.exe
    "C:\Users\Admin\AppData\Local\Temp\b815acf7a5c98bbb90373602f939d6683f22d23728070b53e11ef0f26749964c.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1048

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

    Filesize

    53KB

    MD5

    88f2f974b0d3cdc2c703ff5d2c301789

    SHA1

    c408a13e1b43dc68ec44731f125ba12833ffa6fb

    SHA256

    7eb768bb51d6c80c7c7be94bd5aa50d2a8e075b52d5a46a2f3e423d5d95dc86c

    SHA512

    332bbeb38cce5c279c3bf4493e57a6251553652041f148d9bc99ffcf5ce878633839e2c2c699dca6eb546f7dbc204e78f05b7b0443c4a7d487f73807135e64ea

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    61KB

    MD5

    dbd19f14437f2b1a9fbe3a6c24f99854

    SHA1

    8acc2fcbc283881a840a0eb19bda14e33a8d886c

    SHA256

    42db1681486247fbb2ab3c9c3c4bccb7e425547b2db9cb41096a05f6f337baae

    SHA512

    ae72709ededff9f778ac1416c994119acd32fae0980907abd5620184734012337d59e8a42d889dd253cddeb43c1e410c086d377c8771c5c7f30b2ed609c9f30d

  • memory/1048-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1048-70-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB