591ac3fef8e9907eb0d3b684a885ec6bd77283fd94bf2229fb2a71935ac42557 | Triage

Sharing

General

Target

0f8166887452240d179cb666a09afc70N.exe
Size

84KB
Sample

240723-1hmtfstake
MD5

0f8166887452240d179cb666a09afc70
SHA1

89a0a1f22f7b47a901cdd543d17d019a89e3b620
SHA256

591ac3fef8e9907eb0d3b684a885ec6bd77283fd94bf2229fb2a71935ac42557
SHA512

a40eb4e765d39f7830c3081415193ad53104fc79c79c6d5357a6695c33b115d50ebc7f53d14119b120320983f52469473ece56dcf193c84f90821ccb9a2645b1
SSDEEP

768:W7BlpppARFbhFAxC97BlpppARFbhFAxCf:W7ZppApT7ZppApN

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  0f8166887452240d179cb666a09afc70N.exe
- Size
  
  84KB
- MD5
  
  0f8166887452240d179cb666a09afc70
- SHA1
  
  89a0a1f22f7b47a901cdd543d17d019a89e3b620
- SHA256
  
  591ac3fef8e9907eb0d3b684a885ec6bd77283fd94bf2229fb2a71935ac42557
- SHA512
  
  a40eb4e765d39f7830c3081415193ad53104fc79c79c6d5357a6695c33b115d50ebc7f53d14119b120320983f52469473ece56dcf193c84f90821ccb9a2645b1
- SSDEEP
  
  768:W7BlpppARFbhFAxC97BlpppARFbhFAxCf:W7ZppApT7ZppApN
Score

9^/10

discovery ransomware
- Renames multiple (3380) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware