23539d0bab8799e9d6caf81f2a798c037fc6f9931bcb4dc40fe0b394633b8fd0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b15799dc752fdbd6b274d73fc1556410N.exe
Size

191KB
Sample

240818-rmc1dazgjj
MD5

b15799dc752fdbd6b274d73fc1556410
SHA1

d297a6d8dddf7251b7fd54d8d60d6b71fc350e3d
SHA256

23539d0bab8799e9d6caf81f2a798c037fc6f9931bcb4dc40fe0b394633b8fd0
SHA512

6f2a81c572c91434321bd6b1c24401ca126d5868658fbaf6f60c8b8f73811d61b58f100b3f326a04b884bc424dd460123903c9d3e8058cbd9829d5b4dbf18997
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBE:PqFF2Ie+efsLCqFF2Ie+efsLrwP

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  b15799dc752fdbd6b274d73fc1556410N.exe
- Size
  
  191KB
- MD5
  
  b15799dc752fdbd6b274d73fc1556410
- SHA1
  
  d297a6d8dddf7251b7fd54d8d60d6b71fc350e3d
- SHA256
  
  23539d0bab8799e9d6caf81f2a798c037fc6f9931bcb4dc40fe0b394633b8fd0
- SHA512
  
  6f2a81c572c91434321bd6b1c24401ca126d5868658fbaf6f60c8b8f73811d61b58f100b3f326a04b884bc424dd460123903c9d3e8058cbd9829d5b4dbf18997
- SSDEEP
  
  3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBE:PqFF2Ie+efsLCqFF2Ie+efsLrwP
Score

9^/10

discovery ransomware
- Renames multiple (3495) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware