138f655ca6ebe69012e6c81c494147006135926da6d651a6110c0bcfc96c4dde | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1b0636bd473b44c73cf4e1b2b7cbfa40N.exe
Size

104KB
Sample

240817-zl3teayfkm
MD5

1b0636bd473b44c73cf4e1b2b7cbfa40
SHA1

d92097cffe53fc01528a6ef9d328ea6f9fbb97c2
SHA256

138f655ca6ebe69012e6c81c494147006135926da6d651a6110c0bcfc96c4dde
SHA512

b1e8ad85e9959c2301aa111c9f2adccb7ea73a807b831afab1d540a425fa5319b43913c08d29ecafdceb5a79bc472f94a80ed4fe9534a535a1ab770c6c17239a
SSDEEP

768:W7BlpppARFbhHFoqAJwBqAJw70EXBwzEXBw07BlpppARFbhHFoqAJwBqAJw70EXp:W7ZppApg7ZppApe

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  1b0636bd473b44c73cf4e1b2b7cbfa40N.exe
- Size
  
  104KB
- MD5
  
  1b0636bd473b44c73cf4e1b2b7cbfa40
- SHA1
  
  d92097cffe53fc01528a6ef9d328ea6f9fbb97c2
- SHA256
  
  138f655ca6ebe69012e6c81c494147006135926da6d651a6110c0bcfc96c4dde
- SHA512
  
  b1e8ad85e9959c2301aa111c9f2adccb7ea73a807b831afab1d540a425fa5319b43913c08d29ecafdceb5a79bc472f94a80ed4fe9534a535a1ab770c6c17239a
- SSDEEP
  
  768:W7BlpppARFbhHFoqAJwBqAJw70EXBwzEXBw07BlpppARFbhHFoqAJwBqAJw70EXp:W7ZppApg7ZppApe
Score

9^/10

discovery ransomware
- Renames multiple (4085) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware