cff8ab1dfa13e7bef413d2578502cf466d75f05c5a73bab7bfb634470dba57ea | Triage

Sharing

General

Target

cff8ab1dfa13e7bef413d2578502cf466d75f05c5a73bab7bfb634470dba57ea
Size

83KB
Sample

240812-czv96awajc
MD5

1319481afa3f52271810a1ace6fc7e2d
SHA1

93a31ba7fe4668bdd248d5d9c2deedf72958fdd0
SHA256

cff8ab1dfa13e7bef413d2578502cf466d75f05c5a73bab7bfb634470dba57ea
SHA512

9d052f2c64aa1efe07763ecfa055c8d8eec9641d0938fce95a79f2bf53e33a6f8bcb23365a4f59cfbd11e3a7a45ae305a08515e180565d74bc70d7db1c31ad80
SSDEEP

1536:W7ZhA7pApM21LOA1LO2c6b25gc6b25uCrbpSvr5xpYr0ARZF6NFVogjQlRv/L6:6e7WpMgLOiLO2c6b25gc6b25uwUhQ7X+

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  cff8ab1dfa13e7bef413d2578502cf466d75f05c5a73bab7bfb634470dba57ea
- Size
  
  83KB
- MD5
  
  1319481afa3f52271810a1ace6fc7e2d
- SHA1
  
  93a31ba7fe4668bdd248d5d9c2deedf72958fdd0
- SHA256
  
  cff8ab1dfa13e7bef413d2578502cf466d75f05c5a73bab7bfb634470dba57ea
- SHA512
  
  9d052f2c64aa1efe07763ecfa055c8d8eec9641d0938fce95a79f2bf53e33a6f8bcb23365a4f59cfbd11e3a7a45ae305a08515e180565d74bc70d7db1c31ad80
- SSDEEP
  
  1536:W7ZhA7pApM21LOA1LO2c6b25gc6b25uCrbpSvr5xpYr0ARZF6NFVogjQlRv/L6:6e7WpMgLOiLO2c6b25gc6b25uwUhQ7X+
Score

9^/10

discovery ransomware
- Renames multiple (3753) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware