Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-11-2024 21:32

General

  • Target

    43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe

  • Size

    73KB

  • MD5

    1b7a2118de66e8e86ba6fbb393590e33

  • SHA1

    844c9ba13dea247239fa464b231b54030e693c9c

  • SHA256

    43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5

  • SHA512

    de8b1faf39b93197b7b4683085fbeb0564f5d54854cb2d986c7d45cab587481df9ae1512916201895b7bfa2fc8e2a3d04195642eaf61f4b147b98eb2d1fc4ba5

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/ti8zD1Gn24:V7Zf/FAxTWoJJ7TTQoQ87NMp

Malware Config

Signatures

  • Renames multiple (4653) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe
    "C:\Users\Admin\AppData\Local\Temp\43e9e8c119327d4d74f0aa4fc71924bf2bd072882a40ea8af43b6338a88a72e5.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3952

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-493223053-2004649691-1575712786-1000\desktop.ini.tmp

    Filesize

    73KB

    MD5

    9ec3bfc9a270ef68b1b5ff717567cba5

    SHA1

    d190268cce56d057f3cc8c83007739a958f27741

    SHA256

    e8a1930dba0c8eb848789935d4d43c3d6fa6f25555e4e4c2cd89bc2557e0e667

    SHA512

    cb3b92aa639c3ce5b5ae3e707f644d973513f2d766a95774da96843881b5b5bbb8f4c1735b5f1132742b9c7b3c6fae3062896ffd41d5d9e7509de0151abb7f3d

  • C:\Program Files\7-Zip\7-zip.dll.exe

    Filesize

    172KB

    MD5

    61b217b1d23e8395850135220691094d

    SHA1

    10da2e8beb70e39c940d4d824beb797f1016d34d

    SHA256

    fbac5101531a8782034c0c6af4ac0072dd23176ee31766b6edb928cab9633f80

    SHA512

    4873f1fa12edbf0686f43548fa9d766be34cef8850f063d49e934e60cd7d0760e39da7ecff64aa3aefd38c7e943282b1f387bd6099d521ccb668029667464a16

  • memory/3952-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3952-652-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB