914320682a241af5cbddb630ea0f04d3ef01743037f124854a7840fde8cb7798 | Triage

Sharing

General

Target

4ef0b7ff3384a8ee029c24cde0acf280N.exe
Size

83KB
Sample

240818-21l6bashlr
MD5

4ef0b7ff3384a8ee029c24cde0acf280
SHA1

eb2718397fd758b056602103e387fb062b906871
SHA256

914320682a241af5cbddb630ea0f04d3ef01743037f124854a7840fde8cb7798
SHA512

c75bc9ebc0568fc2a26bc455f62ceaf86b6ebf4cadcdbee29805689e03a443dd73badd570e62d565d3aa2254605c9cba2667b60dcfe61686b30b4c38da31d4b7
SSDEEP

1536:W7ZppApBULcfpHLcfpyD2nU7ZppApBULcfpHLcfpyD2nM:6pWpBwchcwD2nUpWpBwchcwD2nM

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  4ef0b7ff3384a8ee029c24cde0acf280N.exe
- Size
  
  83KB
- MD5
  
  4ef0b7ff3384a8ee029c24cde0acf280
- SHA1
  
  eb2718397fd758b056602103e387fb062b906871
- SHA256
  
  914320682a241af5cbddb630ea0f04d3ef01743037f124854a7840fde8cb7798
- SHA512
  
  c75bc9ebc0568fc2a26bc455f62ceaf86b6ebf4cadcdbee29805689e03a443dd73badd570e62d565d3aa2254605c9cba2667b60dcfe61686b30b4c38da31d4b7
- SSDEEP
  
  1536:W7ZppApBULcfpHLcfpyD2nU7ZppApBULcfpHLcfpyD2nM:6pWpBwchcwD2nUpWpBwchcwD2nM
Score

9^/10

discovery ransomware
- Renames multiple (4380) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware