Analysis

  • max time kernel
    120s
  • max time network
    105s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-10-2024 01:16

General

  • Target

    3bb27c05f213f283e5c4dc3ebe5935dfc2aa5599272647096dfc78b11d31ef10N.exe

  • Size

    696KB

  • MD5

    d4f709d5babb3c7bb6fb6ffb8e970bb0

  • SHA1

    eafc7100ba60020df7747368e81d88c282ce5c61

  • SHA256

    3bb27c05f213f283e5c4dc3ebe5935dfc2aa5599272647096dfc78b11d31ef10

  • SHA512

    d8610d7f41b0c6a1c8e70fa0508074bd4dd6d7b6692f37e9e1f338da9da2ca55d6ffd6a0a47bf34248c59516c9a1cff6268be4a2dba9a0f914cfa2e1558714a3

  • SSDEEP

    12288:Qz1EZjO099+7fdJpKe0GbD2KCnymDY4SHW3L3cM4gEC4hqPQX7QuUgVfU:99M7fdJpKvGbD2KCnymDY4S23L3cM4gH

Score
9/10

Malware Config

Signatures

  • Renames multiple (2117) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\3bb27c05f213f283e5c4dc3ebe5935dfc2aa5599272647096dfc78b11d31ef10N.exe
    "C:\Users\Admin\AppData\Local\Temp\3bb27c05f213f283e5c4dc3ebe5935dfc2aa5599272647096dfc78b11d31ef10N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:4036

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3442511616-637977696-3186306149-1000\desktop.ini.tmp

    Filesize

    696KB

    MD5

    616f547f1d3065bb31c98bc4bb209dcb

    SHA1

    c2ebcf6a719a045abd8bc0b0b5f7bacd104ccef3

    SHA256

    69945102664c866bb75bbdd698f886046c4babc671c6ef94eb4da0fc39d79d53

    SHA512

    530a61dc70707e20c41d6722f6fccda04ec474b3bea8237033e6a4be302df0a56c35c8f005fcace0debe70b8d14d8d18dab22a857a0b3501107c3195b3dd2178

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    795KB

    MD5

    3d97c450f6575009dce34a040e7b39bf

    SHA1

    f886e817f0e6d74a5e5c6b473404f8a7d8d5b117

    SHA256

    8c728c3be5679218f7b23edda90bfe689f5cca40f6132f891651c0ad7889c813

    SHA512

    b1da577563c994d030c3376701de6abf400e27d00d5f0977e41e256058eb674ba49fa09bceb82271544331bab80fbb82a974592eb281730fe1c318f87ff0f404