a64fe28123b6be6c42e620f9a6d99357ff161e11fb78ec5dd75f96ab25a488c9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a64fe28123b6be6c42e620f9a6d99357ff161e11fb78ec5dd75f96ab25a488c9
Size

85KB
Sample

240818-dfe99s1gke
MD5

0fe115cbf8fc99e3e3847c3793f5b0b8
SHA1

5a30705a705acfb00f752cd8ae6e2ed6123382ad
SHA256

a64fe28123b6be6c42e620f9a6d99357ff161e11fb78ec5dd75f96ab25a488c9
SHA512

aa05a1bfdcc7cbe1d8297d78e3969a3d71d2bf197ed22734462caee08a72d81e9cb68c6041ebd581feae5b2fdc5582bd50221590cbdfbaf32c1ce815d305ca23
SSDEEP

768:W7Blp9pARFbhxwWj+7Blp9pARFbhxwWj8:W7Z9pApxwB7Z9pApxwl

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  a64fe28123b6be6c42e620f9a6d99357ff161e11fb78ec5dd75f96ab25a488c9
- Size
  
  85KB
- MD5
  
  0fe115cbf8fc99e3e3847c3793f5b0b8
- SHA1
  
  5a30705a705acfb00f752cd8ae6e2ed6123382ad
- SHA256
  
  a64fe28123b6be6c42e620f9a6d99357ff161e11fb78ec5dd75f96ab25a488c9
- SHA512
  
  aa05a1bfdcc7cbe1d8297d78e3969a3d71d2bf197ed22734462caee08a72d81e9cb68c6041ebd581feae5b2fdc5582bd50221590cbdfbaf32c1ce815d305ca23
- SSDEEP
  
  768:W7Blp9pARFbhxwWj+7Blp9pARFbhxwWj8:W7Z9pApxwB7Z9pApxwl
Score

9^/10

discovery ransomware
- Renames multiple (4934) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware