Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250502-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/05/2025, 13:42

General

  • Target

    c3bd7c16da1af87ebb2f1664545a4a3c22ca99869895997c70cb3e6e3c836e0a.exe

  • Size

    31KB

  • MD5

    afc9fd46a709f1dfeb05928326298908

  • SHA1

    edf2b417d616f64cb1381c82f164479b08130132

  • SHA256

    c3bd7c16da1af87ebb2f1664545a4a3c22ca99869895997c70cb3e6e3c836e0a

  • SHA512

    193f649c67b61f52228e6c3a6f970833f1ad7406c3397abfe66db15cba992199f1edc811b09f3af38ca0f9d04c8e8d3c3eb6c533a1c0f50eac1251807f04160b

  • SSDEEP

    384:gBt7Br5xjL9AgA71FbhvP/KWLsqmFae+rOAqmFae+rOfijcijP:s7BlpppARFbhdLz8ae+rOn8ae+rOfXK

Score
9/10

Malware Config

Signatures

  • Renames multiple (5227) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c3bd7c16da1af87ebb2f1664545a4a3c22ca99869895997c70cb3e6e3c836e0a.exe
    "C:\Users\Admin\AppData\Local\Temp\c3bd7c16da1af87ebb2f1664545a4a3c22ca99869895997c70cb3e6e3c836e0a.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1088

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-3690492401-2005096563-3427069815-1000\desktop.ini.tmp

          Filesize

          32KB

          MD5

          414fc1f419577e596cfb1a37a59270d7

          SHA1

          4990789e4363514ec43487ebe4aa77b640cf533c

          SHA256

          2c042f0209460629487463cf555369e2edc71203fd68d20f12cc0ebb130f8015

          SHA512

          993b816c17c22521efdf479807cf32a1224919eae79c74f4d69f15489be31674f76f399eea5830ef953b7b4ae9076792feec67dddcb7464ae45030b2fb983ea4

        • C:\f32c6debfbe15d219b06a854\2010_x64.log.html.tmp

          Filesize

          117KB

          MD5

          cb2faef812464ed76b920517e0c80833

          SHA1

          c6f7d0867d485ce39b3d53cba6953b0abe5826dd

          SHA256

          6a989b50253d2a3530b640c837694e616bdc5bdcc7c8ccf058ab5263b0eb373c

          SHA512

          c250adc81b1915a22ded483ed0ba42c9897ca2ca19b67edee801ae1642651ffadafc65b420a098b31bbfaa055dd408309d7996e5503f51755661d6ce7ab01421