Analysis

  • max time kernel
    120s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-10-2024 03:12

General

  • Target

    19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe

  • Size

    31KB

  • MD5

    b80cd31087452fd3015c08670a167780

  • SHA1

    7e5d4bb1d1af7797422c206720ed4a4cd851d13a

  • SHA256

    19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230

  • SHA512

    e530fc7f6189bf3f6bc8a6d804b5d07a9216a53c0106a5329dd308231d8f0e747104fd1fee1bd49534a18e595c1528f88cde626c6608d36f70298f2f4af00a16

  • SSDEEP

    768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9woOzOuiJfoOzOuiJNaI9aIOt:CTW7JJ7T4MFt

Malware Config

Signatures

  • Renames multiple (4648) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe
    "C:\Users\Admin\AppData\Local\Temp\19c4f1cd40170869f44ced51d2ae1b4cb0c1eb034a14cd5f874491f8c561d230N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1008

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini.tmp

    Filesize

    31KB

    MD5

    a4674cb13945da20d516f0cc37839ffb

    SHA1

    75bbe0c5252fc4196ad593576ffd34df33bad4a7

    SHA256

    12df7eefdbd64be39e0f9fbed00f5efb7b272519e0ac3b0150e0b8b6dbc00e4f

    SHA512

    5f95eb7beba0027007fcb0cd95847953250e98845fde84021a148a1d7149705e9841b7e5ca1178e0baa13f61b9badb1e823f4d9126f506d5fcbd8ba86bb1bd63

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    130KB

    MD5

    49f68afd7fc73c0d8e3c12cab2a59f9b

    SHA1

    6587afe8a7efa253b6d15af4166c2f1b1cb98a84

    SHA256

    9e8ea7a4d6472dde69c7785edbeb080c9212f9ce412e3f0dd82fd9a2c9038907

    SHA512

    4c88b138343775141f410cb03d45164edcf1a09920c39ec766d2a7a872a3bcbc45c893e93f9844a8e48973aada6182928b8696f10c93d2a840774a8a2b48e786

  • memory/1008-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1008-786-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB