Resubmissions

17/03/2025, 08:49

250317-krbvjsvzbz 5

03/02/2025, 06:35

250203-hcksssvpaq 9

01/02/2025, 08:21

250201-j874msvmh1 9

01/02/2025, 05:00

250201-fm6rxasle1 9

Analysis

  • max time kernel
    35s
  • max time network
    35s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/02/2025, 05:00

General

  • Target

    main.exe

  • Size

    6KB

  • MD5

    9c30c4744d7d505f5f9a24b6b4c9bebb

  • SHA1

    a71f4144b6f0a5edffc933e6dd08782cd60e0dc3

  • SHA256

    31ff48d218e462b4c1f3de03778c60b99bd1ef0d03a974070abb056138a1754b

  • SHA512

    f8755c78f516dc1ef99001569de57c5215b139e5eedfb1547c395a9ba7ad23fa28d0038d4a8d0d23b7b9d6dd91504bd506d443074d55c731b15dfe307b01f5af

  • SSDEEP

    96:JgsXR2CODflB3W031gBiSMaxguF0rayQBJZJ8LBFhyW5BBZpsyY0l:RXR2HB3W/Bg5dayAn2ryuBZV

Score
9/10

Malware Config

Signatures

  • Renames multiple (54) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    1⤵
    • Sets desktop wallpaper using registry
    PID:2964

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2964-0-0x00007FFEF9423000-0x00007FFEF9425000-memory.dmp

    Filesize

    8KB

  • memory/2964-1-0x0000000000530000-0x0000000000538000-memory.dmp

    Filesize

    32KB

  • memory/2964-29-0x00007FFEF9420000-0x00007FFEF9EE1000-memory.dmp

    Filesize

    10.8MB

  • memory/2964-112-0x00007FFEF9423000-0x00007FFEF9425000-memory.dmp

    Filesize

    8KB

  • memory/2964-113-0x00007FFEF9420000-0x00007FFEF9EE1000-memory.dmp

    Filesize

    10.8MB