11019b03143b5bde75acf972f2707591fc4ea6fddaa1ab0fdb2620428573315b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

76732afdf0b7c13d835b200a85f21960N.exe
Size

124KB
Sample

240819-ry481azclf
MD5

76732afdf0b7c13d835b200a85f21960
SHA1

45703bf51cdbd6466383700fb315346a530493e6
SHA256

11019b03143b5bde75acf972f2707591fc4ea6fddaa1ab0fdb2620428573315b
SHA512

76a6e6d16ac2f9a301b904900c9fce40f355151a0af4e83c076fefbed9477c9cd6ed4caaf0dee7687924d2da499978333566558fe2d45a32a8ced12bcf749459
SSDEEP

1536:W7ZppApBULcfpHLcfpX2/Nw/NwmxL7ZppApBULcfpHLcfpX2/Nw/NwmxMfp:6pWpBwchcV2WxppWpBwchcV2WxMfp

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  76732afdf0b7c13d835b200a85f21960N.exe
- Size
  
  124KB
- MD5
  
  76732afdf0b7c13d835b200a85f21960
- SHA1
  
  45703bf51cdbd6466383700fb315346a530493e6
- SHA256
  
  11019b03143b5bde75acf972f2707591fc4ea6fddaa1ab0fdb2620428573315b
- SHA512
  
  76a6e6d16ac2f9a301b904900c9fce40f355151a0af4e83c076fefbed9477c9cd6ed4caaf0dee7687924d2da499978333566558fe2d45a32a8ced12bcf749459
- SSDEEP
  
  1536:W7ZppApBULcfpHLcfpX2/Nw/NwmxL7ZppApBULcfpHLcfpX2/Nw/NwmxMfp:6pWpBwchcV2WxppWpBwchcV2WxMfp
Score

9^/10

discovery ransomware
- Renames multiple (3177) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware