Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-10-2024 01:26

General

  • Target

    b815acf7a5c98bbb90373602f939d6683f22d23728070b53e11ef0f26749964c.exe

  • Size

    52KB

  • MD5

    ae1a89352084bcac1bbf4715a9b6ad95

  • SHA1

    e1441f378036a05ea10e1a052a97e3a468380cba

  • SHA256

    b815acf7a5c98bbb90373602f939d6683f22d23728070b53e11ef0f26749964c

  • SHA512

    a65a9be904bd44a3db322823766bf11a449d58f4fc74ccf2524685d55377d781b1fc67090c5fe50b67e221e53c11fab86f9881dc1543a63a32495e7484944bcc

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9X:V7Zf/FAxTWoJJ7Td

Malware Config

Signatures

  • Renames multiple (5169) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b815acf7a5c98bbb90373602f939d6683f22d23728070b53e11ef0f26749964c.exe
    "C:\Users\Admin\AppData\Local\Temp\b815acf7a5c98bbb90373602f939d6683f22d23728070b53e11ef0f26749964c.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:4640

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-940901362-3608833189-1915618603-1000\desktop.ini.tmp

    Filesize

    53KB

    MD5

    d3cad590f95b731d7a54b05568d93f78

    SHA1

    971e78b3befbfd0890d390b67a76da41fad60459

    SHA256

    682a02c74ede5b82522fb002b5a93d87121ecd92d464253038cdd8f191bc4c9e

    SHA512

    390b265a98cab8b8d5cda44add86d9bb3d3243a32610df6b0c64701009c6bc456fbad7202c9975ada86bcac2fd9dbd77c27939d0f578fc7214b609cc3ba7a493

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    151KB

    MD5

    e10f69baffb065712b643ef076ff2dc7

    SHA1

    2d2c0bdfad38ddb2b89eea636917e94470a7f7c7

    SHA256

    e38a3519b57f31a3c02e6e03cbe15366b305a9a2a364a93dc89ca2c48032d5e2

    SHA512

    309f544b94fffb8d1234f86f377fc16f05eba6f3afe6b4058f96bd9a605afd2a57ea2d5dc905007b8bac935ca827070a29a1dfd65990cd8684cfe988e8230697

  • memory/4640-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/4640-696-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB