495a4f2897d927b6ae558ea54c7d2e2c7482676108a99601f3fde1be300341c8 | Triage

Sharing

General

Target

4192ca0957d70076a47d9ca4906538c0N.exe
Size

81KB
Sample

240726-xcwyds1ana
MD5

4192ca0957d70076a47d9ca4906538c0
SHA1

26c70fe85e15d1c27bc53f685bbdea529fa710f4
SHA256

495a4f2897d927b6ae558ea54c7d2e2c7482676108a99601f3fde1be300341c8
SHA512

947e17cf0d2ae8fef90b40e545eb0fae3ebb2ff9f0edc883624705e4f2ebe10f041a33548cd63c22b300eacb840a5b61734cea584fb159cfca1c56d680f1eff0
SSDEEP

768:/7BlpQpARFbhq1KBTb97BlpQpARFbhq1KBTbhFNFq:/7ZQpApq127ZQpApq1qDq

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  4192ca0957d70076a47d9ca4906538c0N.exe
- Size
  
  81KB
- MD5
  
  4192ca0957d70076a47d9ca4906538c0
- SHA1
  
  26c70fe85e15d1c27bc53f685bbdea529fa710f4
- SHA256
  
  495a4f2897d927b6ae558ea54c7d2e2c7482676108a99601f3fde1be300341c8
- SHA512
  
  947e17cf0d2ae8fef90b40e545eb0fae3ebb2ff9f0edc883624705e4f2ebe10f041a33548cd63c22b300eacb840a5b61734cea584fb159cfca1c56d680f1eff0
- SSDEEP
  
  768:/7BlpQpARFbhq1KBTb97BlpQpARFbhq1KBTbhFNFq:/7ZQpApq127ZQpApq1qDq
Score

9^/10

discovery ransomware
- Renames multiple (4074) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware