Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14-11-2024 21:32

General

  • Target

    43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe

  • Size

    73KB

  • MD5

    1b7a2118de66e8e86ba6fbb393590e33

  • SHA1

    844c9ba13dea247239fa464b231b54030e693c9c

  • SHA256

    43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5

  • SHA512

    de8b1faf39b93197b7b4683085fbeb0564f5d54854cb2d986c7d45cab587481df9ae1512916201895b7bfa2fc8e2a3d04195642eaf61f4b147b98eb2d1fc4ba5

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/ti8zD1Gn24:V7Zf/FAxTWoJJ7TTQoQ87NMp

Malware Config

Signatures

  • Renames multiple (3490) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe
    "C:\Users\Admin\AppData\Local\Temp\43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:840

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp

    Filesize

    73KB

    MD5

    1a8b3438cf37078c5892952bd273eb06

    SHA1

    1ecc7cf967579dcc77db0a4bb314af54350d7584

    SHA256

    9fbff3b1e95978d0ea974522033eb8e7e8213d1a65cf35e00b3bf5a3f8f02403

    SHA512

    67ec3e719d26133f66505035180e5e00276af42488ae04bb1f432e3db79b7bae96a76853bceba0ad1e62c2ececdb500906cc1eff73bc55a69fd987dceb3219ce

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    82KB

    MD5

    b8442cdc3f39656cb7017d19ce811272

    SHA1

    49ed2b715c5e329c14b09a6f82fc8f579bd2c948

    SHA256

    25c76ad9f81a824245a2440dcd87608522489551486bd08d015bdfb2e108f544

    SHA512

    3f5d536ce56b2a592f46682ca120beda5c8d4ecdb4a262026e1de17afecfd34aff873ba5d7b975ea9cc617df2976a05d2dfdbf9f04c64eac246b8ffeec3f707a

  • memory/840-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/840-70-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB