Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-10-2024 01:36

General

  • Target

    b815acf7a5c98bbb90373602f939d6683f22d23728070b53e11ef0f26749964c.exe

  • Size

    52KB

  • MD5

    ae1a89352084bcac1bbf4715a9b6ad95

  • SHA1

    e1441f378036a05ea10e1a052a97e3a468380cba

  • SHA256

    b815acf7a5c98bbb90373602f939d6683f22d23728070b53e11ef0f26749964c

  • SHA512

    a65a9be904bd44a3db322823766bf11a449d58f4fc74ccf2524685d55377d781b1fc67090c5fe50b67e221e53c11fab86f9881dc1543a63a32495e7484944bcc

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9X:V7Zf/FAxTWoJJ7Td

Malware Config

Signatures

  • Renames multiple (5190) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b815acf7a5c98bbb90373602f939d6683f22d23728070b53e11ef0f26749964c.exe
    "C:\Users\Admin\AppData\Local\Temp\b815acf7a5c98bbb90373602f939d6683f22d23728070b53e11ef0f26749964c.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2320

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3350944739-639801879-157714471-1000\desktop.ini.tmp

    Filesize

    53KB

    MD5

    6e7fb19164c8176b54d3372b6e19cdea

    SHA1

    86280cd1c5591ff3758ec7b2b34fd66f3b4509fd

    SHA256

    faed7dd5981c229283d466b93db796c0f1719adef51f5d424562b37fe887767c

    SHA512

    db9c7849c63d7518de63cfb00ec58f28c99bb5da6d98346e14bd23609893287c1dae784cade5f4a41c7dc53afba0133956cf0e2f2963c77ffb0c626184943f6b

  • C:\Program Files\7-Zip\7-zip.dll.exe

    Filesize

    151KB

    MD5

    af41adcfb6d884339fa97b5a944e1c9e

    SHA1

    5c4ddbfcf9aed4071febbdb38e3260f4e7bc9c43

    SHA256

    b168c010ccb2316170200640ee1a48d50fca8cd622a83f74b991e5014c6292e1

    SHA512

    ee94ee5f869478dc6093fa38087ccbfee043c3faa4d9d83589f4080c3544992c889a1dbfb76db81f47ad1688682f2f3ba60fa5fcddc81f6459f426201eecc710

  • memory/2320-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2320-782-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB