Analysis

  • max time kernel
    120s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12-11-2024 12:14

General

  • Target

    ed6ab1829e344e4c2b52f2894cbed511a28443f583235dad750ed607aa93dde3N.exe

  • Size

    45KB

  • MD5

    5fde3e65c7a9f1c3f5a10795017355d7

  • SHA1

    4e7e2864b1e33569c70200a1c4a4e7bd4f88807f

  • SHA256

    6f7360f8c1aae8cdb7ddf028184d365000287f8807383521a8cba6e97765dac6

  • SHA512

    95ad9729a385e0aec1a7c67f29911f11d96a239f0f12b70fc9886a9a8c9b85e3934be5e2a8f72a85735029c1c9c268e1ffcb734f889da30c7628a5643ba15e6a

  • SSDEEP

    768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFcdyGdy+zWzS//1gk:W7ZppApBULcfpHLcfpyDcdyGdyan

Score
9/10

Malware Config

Signatures

  • Renames multiple (3261) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed6ab1829e344e4c2b52f2894cbed511a28443f583235dad750ed607aa93dde3N.exe
    "C:\Users\Admin\AppData\Local\Temp\ed6ab1829e344e4c2b52f2894cbed511a28443f583235dad750ed607aa93dde3N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2556

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp

    Filesize

    45KB

    MD5

    9c9d10bcd081bd5648cf8e7434949e99

    SHA1

    c0619c9628fa584613d9141f73056b909bce6540

    SHA256

    e64e3e7a5ab1863f8a9654f669c482b1ff1009675d0fb1dbae1e494325b5c4dd

    SHA512

    335aa9dbb5c99ae18c1b8e56e8e2f6514461900cf905e5020a3d9a8df05a54f4b3c23fe1fd0e76444ad146c125607ff3ee68cb32d977b98a925e61862f2f1d12

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    54KB

    MD5

    b02178ca57ae931ed9913015c4e5bd81

    SHA1

    0ff4c665a2132ba8ae617e321a33733aae5f8ce7

    SHA256

    d4d1d3ff2ea52762110c911561c82b2e2bb881431863e95dbb7e1effd28e32f3

    SHA512

    bce1d3ee4932c01053c3ba1dc6653ceba5846b5340d037fa8d389046df3b23a89a2fa39e07a7aa06a2afef3925e2ae505f529006c2e77cbea83ebcf4fa535d46