Overview

overview

9

Static

static

3

185c3d6fee...0N.exe

windows7-x64

9

185c3d6fee...0N.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    185c3d6fee9261049f5a7f877a215880N.exe

  • Size

    527KB

  • Sample

    240720-2cgkxsyala

  • MD5

    185c3d6fee9261049f5a7f877a215880

  • SHA1

    8849125de3ba4305782e1f20b0f9d774c643d30d

  • SHA256

    fb06f7b2f85bb87473f29694a647de7684bfac4a2d5387dd6b45eb96d4d9c7dc

  • SHA512

    8ca932804b150b0de1738ba9e20cb7a23a4cd1135a9ac37e0367e4574e0581f4cedd7c6855008fbc9ad436176874a0433f9e34117d74aa3267733fec005668a8

  • SSDEEP

    12288:TymOcB+pwPprnVmLmDsC+FU+ZOSzt9tzZg:TLOsDFncLmKDZOSzXFZg

Score
9/10
discoveryransomware

Malware Config

Targets

    • Target

      185c3d6fee9261049f5a7f877a215880N.exe

    • Size

      527KB

    • MD5

      185c3d6fee9261049f5a7f877a215880

    • SHA1

      8849125de3ba4305782e1f20b0f9d774c643d30d

    • SHA256

      fb06f7b2f85bb87473f29694a647de7684bfac4a2d5387dd6b45eb96d4d9c7dc

    • SHA512

      8ca932804b150b0de1738ba9e20cb7a23a4cd1135a9ac37e0367e4574e0581f4cedd7c6855008fbc9ad436176874a0433f9e34117d74aa3267733fec005668a8

    • SSDEEP

      12288:TymOcB+pwPprnVmLmDsC+FU+ZOSzt9tzZg:TLOsDFncLmKDZOSzXFZg

    Score
    9/10
    discoveryransomware

    • Renames multiple (2897) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks