Analysis

  • max time kernel
    120s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-11-2024 12:14

General

  • Target

    ed6ab1829e344e4c2b52f2894cbed511a28443f583235dad750ed607aa93dde3N.exe

  • Size

    45KB

  • MD5

    5fde3e65c7a9f1c3f5a10795017355d7

  • SHA1

    4e7e2864b1e33569c70200a1c4a4e7bd4f88807f

  • SHA256

    6f7360f8c1aae8cdb7ddf028184d365000287f8807383521a8cba6e97765dac6

  • SHA512

    95ad9729a385e0aec1a7c67f29911f11d96a239f0f12b70fc9886a9a8c9b85e3934be5e2a8f72a85735029c1c9c268e1ffcb734f889da30c7628a5643ba15e6a

  • SSDEEP

    768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFcdyGdy+zWzS//1gk:W7ZppApBULcfpHLcfpyDcdyGdyan

Score
9/10

Malware Config

Signatures

  • Renames multiple (4573) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed6ab1829e344e4c2b52f2894cbed511a28443f583235dad750ed607aa93dde3N.exe
    "C:\Users\Admin\AppData\Local\Temp\ed6ab1829e344e4c2b52f2894cbed511a28443f583235dad750ed607aa93dde3N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:4868

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3350944739-639801879-157714471-1000\desktop.ini.tmp

    Filesize

    45KB

    MD5

    9d59ada64c6662a9a570be529e089179

    SHA1

    1406d46b165d6294b27c6e04ee7c7f9c25503f91

    SHA256

    b55d9082ac3b59c9d94787e27b446ce75cdf93a6649fe4ec46179b0fa7425c5a

    SHA512

    01813069ff648c398720aec66e0448aa8905e594181d80549eac0d72cb588efdb5dacf4170e1d730094a835bf18a449f3c41675cb33be3de34ccf256e34d5283

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    144KB

    MD5

    2f4364a2510cb834635488cdf01b2ba9

    SHA1

    6800b4be6af6453245600dfd8f371d1dffa6713b

    SHA256

    f45d19ebf376a4311aad038d7cea2d08f6b64b53a18526b099c7bde2abbe0b46

    SHA512

    1e6b2cdf23996a3f004bf1e2057640f508939528ccbd61ec8e7b2e487d4b2153616577ce42d37cfcddc91dbda457c3b4f450d4c18250bd8c53dd1176a6e7b4d2