Analysis

  • max time kernel
    119s
  • max time network
    20s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20-10-2024 03:24

General

  • Target

    3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe

  • Size

    56KB

  • MD5

    788b975223e3a4bea328f2c8bea0a280

  • SHA1

    3129fabb60b2787c963110406583a0c1885b032f

  • SHA256

    3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384

  • SHA512

    655655bb7cc48891f0126972b79e277abcacbb37f6bad4b6adff8f6458bba0f30a17b10e69ffa91130827649ecb69e495c0f456caa18d154dd6f62cb0ec8e26b

  • SSDEEP

    768:W7BlphA7dASbSjJJcbQbf1Oti1JGBQOOiQJhATNyQYCpCPzzgpQZ+zzgpQZ+TQp7:W7ZhA7dABJJZENTNyQYCpCP44sjTj64R

Score
9/10

Malware Config

Signatures

  • Renames multiple (3165) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe
    "C:\Users\Admin\AppData\Local\Temp\3b1cdaa96da09ad7a7b1bef18a76b96c0853d580e64c63227ca6c26601971384N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1724

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

    Filesize

    57KB

    MD5

    ce92714066bde13e6bc72224818fe232

    SHA1

    069200e1fd3bd664a138c90b095f17f1c5468268

    SHA256

    a79cdf677c8cba62f65e7f4c74fe460a65b5c5b488b7fbd77ce5faa14766da75

    SHA512

    7b891ec0d018906b2622cb0674cf59a9d469da2185e317356b960794ce27c16eebd7d679b7e9e0e58fec09295bfec8d4d2e4e40d4fb6cfd3835745ea67e359dc

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    65KB

    MD5

    45bb866d8fb6d291631c40831b6e19a3

    SHA1

    f2bf6f74efee2ca21d357d96eb93d362d0b7de8c

    SHA256

    fe2b05469409afebabd8f5ec90364a24a4d91315cf568d4d3e4976aeb8ce3e91

    SHA512

    213a1a7d310b5883fed7cb663190be3e43b9856cea3c8ad72d5545bc92df2163e8e184dae40b9cc75ed0cd87ba36fa812f5a4cc756d7252fee6d7a378ead87b0