025b3b15303471502128be11ef6d32b127a9fff2bb036478b5669360d24c9992 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

11a45f549bfaa6c044c23803dc118b70N.exe
Size

85KB
Sample

240727-2wzkvaweme
MD5

11a45f549bfaa6c044c23803dc118b70
SHA1

3a93a5c993e14aed1c9824b8a69563c8eff749b1
SHA256

025b3b15303471502128be11ef6d32b127a9fff2bb036478b5669360d24c9992
SHA512

ae5c36b020f4b521cfb1eb6c65f97481438c58bfb2aeab71abbfa6b385004bf5d15c63cd727eaaa7461b5787c5f32b48540c60548397b1eb31e1348932259c0d
SSDEEP

1536:W7ZppApBULcfpHLcfp/ZeLPy7ZppApBULcfpHLcfp/ZeLP1:6pWpBwchc5ZeSpWpBwchc5Ze5

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  11a45f549bfaa6c044c23803dc118b70N.exe
- Size
  
  85KB
- MD5
  
  11a45f549bfaa6c044c23803dc118b70
- SHA1
  
  3a93a5c993e14aed1c9824b8a69563c8eff749b1
- SHA256
  
  025b3b15303471502128be11ef6d32b127a9fff2bb036478b5669360d24c9992
- SHA512
  
  ae5c36b020f4b521cfb1eb6c65f97481438c58bfb2aeab71abbfa6b385004bf5d15c63cd727eaaa7461b5787c5f32b48540c60548397b1eb31e1348932259c0d
- SSDEEP
  
  1536:W7ZppApBULcfpHLcfp/ZeLPy7ZppApBULcfpHLcfp/ZeLP1:6pWpBwchc5ZeSpWpBwchc5Ze5
Score

9^/10

discovery ransomware
- Renames multiple (2880) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware