35c725a96283e96758d6d964d365f87a3090fd6a3caab6121e619af5b63b8da8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

568e6e249d3784c1f7bfd1c0ff7593d0N.exe
Size

149KB
Sample

240724-gta49avcle
MD5

568e6e249d3784c1f7bfd1c0ff7593d0
SHA1

a71f4d4a847b529cc4d7e4e9992e4aaefb971af4
SHA256

35c725a96283e96758d6d964d365f87a3090fd6a3caab6121e619af5b63b8da8
SHA512

bceaf9870a0e6a51ac9540b8912751fe6486c9b3aef40b628d239e8b55f6dbeb27f2fb9af22b0d774f38aeaabb97c684fdb050efaa4e1313fbe28a19131a6ad1
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eBSDe7WpMaxeb0CYJ97lEYNR73e+eBSp:RqKvb0CYJ973e+eBSCqKvb0CYJ973e+d

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  568e6e249d3784c1f7bfd1c0ff7593d0N.exe
- Size
  
  149KB
- MD5
  
  568e6e249d3784c1f7bfd1c0ff7593d0
- SHA1
  
  a71f4d4a847b529cc4d7e4e9992e4aaefb971af4
- SHA256
  
  35c725a96283e96758d6d964d365f87a3090fd6a3caab6121e619af5b63b8da8
- SHA512
  
  bceaf9870a0e6a51ac9540b8912751fe6486c9b3aef40b628d239e8b55f6dbeb27f2fb9af22b0d774f38aeaabb97c684fdb050efaa4e1313fbe28a19131a6ad1
- SSDEEP
  
  3072:6e7WpMaxeb0CYJ97lEYNR73e+eBSDe7WpMaxeb0CYJ97lEYNR73e+eBSp:RqKvb0CYJ973e+eBSCqKvb0CYJ973e+d
Score

9^/10

discovery ransomware
- Renames multiple (3412) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware