Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-10-2024 02:27

General

  • Target

    d4f9cf6ba03b172f15d8a9a6b02038700384055ff0377cd7162e7a479acbb82a.exe

  • Size

    77KB

  • MD5

    bf0af6f67214b70e88a2f118ad4a5183

  • SHA1

    6482a61a082049eb21344ffa4748cea953d60003

  • SHA256

    d4f9cf6ba03b172f15d8a9a6b02038700384055ff0377cd7162e7a479acbb82a

  • SHA512

    cdb51e046ff66d04c4c775e6ef93f15f6af67f197c3fa65b93b38eb72eca13f3cd6853a9f9073ce155775324511681ae170039ac5b6f2127d21934e663037d9b

  • SSDEEP

    1536:CTWn1++PJHJXA/OsIZfzc3/Q8wYeHNm5EvDxfIyKoIWbsHfySkT5GeCyi348oWGp:KQSodYeHNmkDxfIyKoIWbsHfySkT5GeX

Malware Config

Signatures

  • Renames multiple (5009) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\d4f9cf6ba03b172f15d8a9a6b02038700384055ff0377cd7162e7a479acbb82a.exe
    "C:\Users\Admin\AppData\Local\Temp\d4f9cf6ba03b172f15d8a9a6b02038700384055ff0377cd7162e7a479acbb82a.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:4836

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1045960512-3948844814-3059691613-1000\desktop.ini.tmp

    Filesize

    78KB

    MD5

    960f62eb6b34342ff6e82a6a05b3900f

    SHA1

    4f205afc9dbf01b5ab87dff49e39534ee6c32d7a

    SHA256

    0d9762bd3de73857efbb3e51bb2f2317f58eace94df926b1689e3fa7e8006301

    SHA512

    1fcdf39b7c2e763bb2095cf1f41e05e730ca29343aef91ff52df212d5034ed76f470320cc27ad23639f023d8adef32bcc43510f611c950ca4fb7a5795871ecd0

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    176KB

    MD5

    b2fdf945a40a5648523307c7207cee72

    SHA1

    b7bc5c09a56235896bce7a60a29e37e7bfbb9757

    SHA256

    2fecccea679fd1a12b10d78324755a01ff9a35b83df1e4c0306d0868154e0a9d

    SHA512

    5f932a650356382b01cbf69bc0727af90c7b3a77dd77c0d63e6b7995d60b015f4f4e758052bd7edaa426ae2e11cec1b40491b9488540ff67fbaca3760bc76607

  • memory/4836-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/4836-664-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB