548b55add64df4fe9929c0fbc8b8e913d4a4570b0e92297c3ed543b864f14ad7 | Triage

Sharing

General

Target

9a415c1a913f55019211455dabe45170N.exe
Size

135KB
Sample

240818-ghnk7syfjg
MD5

9a415c1a913f55019211455dabe45170
SHA1

0b4d290c273b6a2b93e3abe69fea0ddd72915ee2
SHA256

548b55add64df4fe9929c0fbc8b8e913d4a4570b0e92297c3ed543b864f14ad7
SHA512

15ddf86ec89316b520ec2865d1e9517056c6f8e599215409b95dd0c9d4b068081f2b05f12ca56a58564d5a92d7d01fc0dc3f83b7924fb7424b9b5629723a2d60
SSDEEP

3072:62ssWpcU7lK1lKgkE12ssWpcU7lK1lKgkEZ:MVyU7lK1lKkVVyU7lK1lKkZ

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  9a415c1a913f55019211455dabe45170N.exe
- Size
  
  135KB
- MD5
  
  9a415c1a913f55019211455dabe45170
- SHA1
  
  0b4d290c273b6a2b93e3abe69fea0ddd72915ee2
- SHA256
  
  548b55add64df4fe9929c0fbc8b8e913d4a4570b0e92297c3ed543b864f14ad7
- SHA512
  
  15ddf86ec89316b520ec2865d1e9517056c6f8e599215409b95dd0c9d4b068081f2b05f12ca56a58564d5a92d7d01fc0dc3f83b7924fb7424b9b5629723a2d60
- SSDEEP
  
  3072:62ssWpcU7lK1lKgkE12ssWpcU7lK1lKgkEZ:MVyU7lK1lKkVVyU7lK1lKkZ
Score

9^/10

discovery ransomware
- Renames multiple (4462) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware