6fd0ab70a409195b61a0d2a4adf62301848719776714594c2551cf10ad123a3d | Triage

Sharing

General

Target

6fd0ab70a409195b61a0d2a4adf62301848719776714594c2551cf10ad123a3d
Size

94KB
Sample

240805-2sgwmavdla
MD5

bf0fdc2de5916fbd605ae3484526aa8f
SHA1

e8a071fa96977f58a7be3e98588dcbf189d84b21
SHA256

6fd0ab70a409195b61a0d2a4adf62301848719776714594c2551cf10ad123a3d
SHA512

5433076b4b661c1d3d9c6e834e4d49a087ff1cf14a3a9adbd27c0029d083910bbdbb24dc0a6958ee21e2d56cfe93018057b132c4731f650f27cf3b16423271d1
SSDEEP

1536:W7ZhA7pApM21LOA1LOIenNTK+I8K/XCKCGSqzVq:6e7WpMgLOiLOIenc+ufC58w

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  6fd0ab70a409195b61a0d2a4adf62301848719776714594c2551cf10ad123a3d
- Size
  
  94KB
- MD5
  
  bf0fdc2de5916fbd605ae3484526aa8f
- SHA1
  
  e8a071fa96977f58a7be3e98588dcbf189d84b21
- SHA256
  
  6fd0ab70a409195b61a0d2a4adf62301848719776714594c2551cf10ad123a3d
- SHA512
  
  5433076b4b661c1d3d9c6e834e4d49a087ff1cf14a3a9adbd27c0029d083910bbdbb24dc0a6958ee21e2d56cfe93018057b132c4731f650f27cf3b16423271d1
- SSDEEP
  
  1536:W7ZhA7pApM21LOA1LOIenNTK+I8K/XCKCGSqzVq:6e7WpMgLOiLOIenc+ufC58w
Score

9^/10

discovery ransomware
- Renames multiple (3791) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware