Analysis

  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12-11-2024 16:00

General

  • Target

    8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe

  • Size

    77KB

  • MD5

    81c20fde6ec37ac57309bb5fb82de46e

  • SHA1

    ee1bf25af1dceb9d149b1e511fc972e278478bb2

  • SHA256

    8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954

  • SHA512

    59f04f44f5155abcc8da8951808f21c1e47cc38aea9e40a83ec2e1b29433defbd0959712f403d16ed04aad081e191e9b2525653b42b51658d339f66c16cb889b

  • SSDEEP

    1536:CTW7JJ7TWsdj2hkAeCgI3i0CJS1Il+lMq:h6yj2yAeCgjJq

Malware Config

Signatures

  • Renames multiple (3398) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe
    "C:\Users\Admin\AppData\Local\Temp\8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2520

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

    Filesize

    77KB

    MD5

    986b23cf81b682dc53aafe5b4a4b3a45

    SHA1

    742a4acafa16868c377d2cb6b282a7149149fb01

    SHA256

    6123935a00fab5a9926da8116dbb563ec8766403d822291b9445479ca5f7e782

    SHA512

    f5e0d23dd21247c671805e11f02fc720f571f731e8c0ef16b2285d23f1b9bf311c65bda0b7745123c36fc1f287faaae9e00faaf89acd4d872fdfdf244beacedb

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    86KB

    MD5

    36c65255b440676e9233207c7d1b059e

    SHA1

    ff8d630175d7bb2415ac9cf7ef6bbde5c315a813

    SHA256

    68d0e1ec777fb7e576da8dd2d77f9e1cd754a7bfd05f08b356f8cdb07e733d63

    SHA512

    f54acd825bc0cf286e922b672386caa1b2390e1fef5ff21b8f524a482e19694da1e54cff0f0a1a698117d03985e3f7c43219c00a3291bc1f953798a50c38aada

  • memory/2520-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2520-51-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB