Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20-10-2024 01:26

General

  • Target

    b815acf7a5c98bbb90373602f939d6683f22d23728070b53e11ef0f26749964c.exe

  • Size

    52KB

  • MD5

    ae1a89352084bcac1bbf4715a9b6ad95

  • SHA1

    e1441f378036a05ea10e1a052a97e3a468380cba

  • SHA256

    b815acf7a5c98bbb90373602f939d6683f22d23728070b53e11ef0f26749964c

  • SHA512

    a65a9be904bd44a3db322823766bf11a449d58f4fc74ccf2524685d55377d781b1fc67090c5fe50b67e221e53c11fab86f9881dc1543a63a32495e7484944bcc

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9X:V7Zf/FAxTWoJJ7Td

Malware Config

Signatures

  • Renames multiple (3694) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b815acf7a5c98bbb90373602f939d6683f22d23728070b53e11ef0f26749964c.exe
    "C:\Users\Admin\AppData\Local\Temp\b815acf7a5c98bbb90373602f939d6683f22d23728070b53e11ef0f26749964c.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2084

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp

    Filesize

    53KB

    MD5

    1eee338c759ebca537db6a9f995606d3

    SHA1

    970d9f8865e9d032b88c62ac9adb99e01637ed41

    SHA256

    a0b9e62e18f2e8c439b7f4406335602c0a48ca6dad5d8f47a7c003364a93aefa

    SHA512

    cab205fa2e35b29bb43e775ca0803924b6bb654112e38578eb8eb25997f73db78d58232ebf27486559674f653f288c9bb6cb7e0ef34eb5d7d2d1f509b165df10

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    61KB

    MD5

    8f8f793516ac849e152c2d0428f9f75b

    SHA1

    08175bed3355c7ff0a90ec51ef4584387eb84361

    SHA256

    1bda95fc2b9863eddd369cb5af2461be4a2ca2172d07e5129ab7d7e372ce6745

    SHA512

    d82c4240caa76e40cd5bff5032d4665c13e43356c8623f80eb7ed328f628d94202db927a0c4731e618b4abc75a6a0902e5edb72ce0287cba71a2d654d3475858

  • memory/2084-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2084-70-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB