Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-11-2024 16:00

General

  • Target

    8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe

  • Size

    77KB

  • MD5

    81c20fde6ec37ac57309bb5fb82de46e

  • SHA1

    ee1bf25af1dceb9d149b1e511fc972e278478bb2

  • SHA256

    8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954

  • SHA512

    59f04f44f5155abcc8da8951808f21c1e47cc38aea9e40a83ec2e1b29433defbd0959712f403d16ed04aad081e191e9b2525653b42b51658d339f66c16cb889b

  • SSDEEP

    1536:CTW7JJ7TWsdj2hkAeCgI3i0CJS1Il+lMq:h6yj2yAeCgjJq

Malware Config

Signatures

  • Renames multiple (4833) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe
    "C:\Users\Admin\AppData\Local\Temp\8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:4872

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3350944739-639801879-157714471-1000\desktop.ini.tmp

    Filesize

    77KB

    MD5

    6f938de1e4809c7dd7c11855af8f94b4

    SHA1

    f0c26ce63800d6e74ec7b0cb1fedd652cb76da61

    SHA256

    524494a3782a680af92746dabf9d3b9e9d6c3f994d8b11353ee766edbaca3eb9

    SHA512

    c556f35fe10d3e0b6f541ee38a99c7969568f768e75ca088acb8f98a2fe401e2f9de9bb201bba06fc4059a806553616acb1b7c3c27c817dc821665ba84c54f04

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    176KB

    MD5

    82eeb708147a4aac0290fe11c3c4ec0f

    SHA1

    f189197791d162fc93913612f845b7e024722349

    SHA256

    31da2eb43fdfaf3059459f871a6d7466ab6d22088eae4a0a5d33556473179804

    SHA512

    74371ca3f99a3d9f9a91767cb19f1a2057a3a87fc45df502fbd22f083141469142896eeb8b557cad7b7d4530151381d6252a5e507afe8c44a440bec94cfccec2

  • memory/4872-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/4872-649-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB