ce720b5b63a54c5c90907fa5126145172521a13b2d4db55cf0c30ac98b2a7ae0 | Triage

Sharing

General

Target

decf89b2b14fc40f0ebcc8c0830d0650N.exe
Size

161KB
Sample

240817-adsk2avgqb
MD5

decf89b2b14fc40f0ebcc8c0830d0650
SHA1

e3be1c9b3d2a9620e1d8c09f91d86b783e5db45b
SHA256

ce720b5b63a54c5c90907fa5126145172521a13b2d4db55cf0c30ac98b2a7ae0
SHA512

78c2393a41fe5f8f359337f8caa8745ee269d323f6e22f5bd96f35e8da4b6f9c14ce0f1628209e2cd3ff795a2201503e8774fc0858eb6fc0f9590a1d5d624466
SSDEEP

3072:6e7WpP9oVLQthbYY9oVLQthbUrt7t5m0mc7me7WpP9oVLQthbYY9oVLQthbUrt7K:RqAbqA4

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  decf89b2b14fc40f0ebcc8c0830d0650N.exe
- Size
  
  161KB
- MD5
  
  decf89b2b14fc40f0ebcc8c0830d0650
- SHA1
  
  e3be1c9b3d2a9620e1d8c09f91d86b783e5db45b
- SHA256
  
  ce720b5b63a54c5c90907fa5126145172521a13b2d4db55cf0c30ac98b2a7ae0
- SHA512
  
  78c2393a41fe5f8f359337f8caa8745ee269d323f6e22f5bd96f35e8da4b6f9c14ce0f1628209e2cd3ff795a2201503e8774fc0858eb6fc0f9590a1d5d624466
- SSDEEP
  
  3072:6e7WpP9oVLQthbYY9oVLQthbUrt7t5m0mc7me7WpP9oVLQthbYY9oVLQthbUrt7K:RqAbqA4
Score

9^/10

discovery ransomware
- Renames multiple (3922) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware