5add0ce8a2eec43b35061092e85238fa6fe24ae35f300da9a92432b677afbce6 | Triage

Sharing

General

Target

aa8968e41f11d09e5dad871fe0270250N.exe
Size

88KB
Sample

240813-t1er8sthkb
MD5

aa8968e41f11d09e5dad871fe0270250
SHA1

63c7fbdbe4599550898618467d03695d19c308b8
SHA256

5add0ce8a2eec43b35061092e85238fa6fe24ae35f300da9a92432b677afbce6
SHA512

b2fb30a23a8ab5dcfac46ac65a301a252e3e942036cebbf7de2d7d5272b20bebd3db8026ca0af0590d262ad5e99527f0f0c215620c66a53520f5af7ec5621862
SSDEEP

1536:/7ZQpApdEKxVTLJtxoVz8FUDrYYaCusjdEKxVTLJtxoVz8FUDrYYaCusjG7ZQpAw:9QWpdEKxVTLJtxoVz8FUDrYYaCusjdEx

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  aa8968e41f11d09e5dad871fe0270250N.exe
- Size
  
  88KB
- MD5
  
  aa8968e41f11d09e5dad871fe0270250
- SHA1
  
  63c7fbdbe4599550898618467d03695d19c308b8
- SHA256
  
  5add0ce8a2eec43b35061092e85238fa6fe24ae35f300da9a92432b677afbce6
- SHA512
  
  b2fb30a23a8ab5dcfac46ac65a301a252e3e942036cebbf7de2d7d5272b20bebd3db8026ca0af0590d262ad5e99527f0f0c215620c66a53520f5af7ec5621862
- SSDEEP
  
  1536:/7ZQpApdEKxVTLJtxoVz8FUDrYYaCusjdEKxVTLJtxoVz8FUDrYYaCusjG7ZQpAw:9QWpdEKxVTLJtxoVz8FUDrYYaCusjdEx
Score

9^/10

discovery ransomware
- Renames multiple (4454) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware