bdf17d16a1bcb980146954a64ddd3c07a41077fe0057c0cb654b9e8526aa3df2 | Triage

Sharing

General

Target

040f02c22a58cda73bdab712668ff530N.exe
Size

85KB
Sample

240801-z4e53a1blh
MD5

040f02c22a58cda73bdab712668ff530
SHA1

2f64865135b147857768ab3489dcec8d7f29e4e7
SHA256

bdf17d16a1bcb980146954a64ddd3c07a41077fe0057c0cb654b9e8526aa3df2
SHA512

63d54edc599b7491ee671c53f169060651a473a9a8b488e0ba7568f1d64b9e6f71d0e717f8facc464f310ddf8d2f40f9cfe74fcce4e9791b90c4e7ac8f00358a
SSDEEP

768:W7BlpppARFbhHFoqAJwBqAJwRJofJoinI5nIv7BlpppARFbhHFoqAJwBqAJwRJoO:W7ZppApaJofJoiw87ZppApaJofJoiwj

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  040f02c22a58cda73bdab712668ff530N.exe
- Size
  
  85KB
- MD5
  
  040f02c22a58cda73bdab712668ff530
- SHA1
  
  2f64865135b147857768ab3489dcec8d7f29e4e7
- SHA256
  
  bdf17d16a1bcb980146954a64ddd3c07a41077fe0057c0cb654b9e8526aa3df2
- SHA512
  
  63d54edc599b7491ee671c53f169060651a473a9a8b488e0ba7568f1d64b9e6f71d0e717f8facc464f310ddf8d2f40f9cfe74fcce4e9791b90c4e7ac8f00358a
- SSDEEP
  
  768:W7BlpppARFbhHFoqAJwBqAJwRJofJoinI5nIv7BlpppARFbhHFoqAJwBqAJwRJoO:W7ZppApaJofJoiw87ZppApaJofJoiwj
Score

9^/10

discovery ransomware
- Renames multiple (4322) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware