Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250502-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/05/2025, 07:23

General

  • Target

    772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe

  • Size

    543KB

  • MD5

    0bd0c76c4ac975e58b0a42ae5379d4c3

  • SHA1

    071c26f93f706b8ba90494e113f6841633306d10

  • SHA256

    772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e

  • SHA512

    25279040ca828171d8a0b8ad01cd118d7578d21fbfff2c354c075c514527650d67fda37328a899bf31acfef414313b5f01def5e598dbaf78f7b0ace1b92a4f17

  • SSDEEP

    12288:9mN9Mttts+n8tGwXglfWF1wUcmN9Mttts+n8tGwXglfWF1wUl:9mNOttts+nKGwXgluF1wtmNOttts+nKZ

Score
9/10

Malware Config

Signatures

  • Renames multiple (3578) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe
    "C:\Users\Admin\AppData\Local\Temp\772e8eba06fe5a14707b606e1649348ff4dae5c86018ef185825b8e4343ab37e.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:5080

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-2930597513-779029253-718817275-1000\desktop.ini.tmp

          Filesize

          544KB

          MD5

          53f6a9a808efa864ccf407a184e464b8

          SHA1

          15991e0643f3bb25946789bed30915ca656f524c

          SHA256

          913fa4bd06701fb16e96878a8c13cee30dea8de164f500e29ed865acb17ecf35

          SHA512

          23b469963613af0c486acc1f953fe635888a866c7ecc74481566fa73c548a7f174860b0e52609034a5f29d5af4cccdee611ef5b043c0b11115cdf6594cb9bdb8

        • C:\6479eedf55783993fe56765264\2010_x86.log.html.tmp

          Filesize

          625KB

          MD5

          fb5558290b8f5a4df6fb593b30c05a43

          SHA1

          3088ed96825a308930d710027722e4311c5a4bb5

          SHA256

          63e7320b14e884e121b53d94911eeda99fd409b5b590c4a603cae12db3116cea

          SHA512

          21657824bb508d91435535db9a4fb4926227e65ef736942b7d58f4200e71dfa87bf9118be75bf2cdfc5ccaf42b60533f42e99c9b64f8b3f0c116e5995cb532b5