353b2124b4fc947a69e0f136f9036155dc5bd16ba7ddced22e0e60c537356175 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bc2f5685c028885d2db06daa1bc147a0N.exe
Size

118KB
Sample

240820-fw3fvavdqa
MD5

bc2f5685c028885d2db06daa1bc147a0
SHA1

f3a17c0e28e6656def525a5ee1fcdf93a916853a
SHA256

353b2124b4fc947a69e0f136f9036155dc5bd16ba7ddced22e0e60c537356175
SHA512

02575f92c84beb99967551ae1f288dedf8394365621491af57e234864d0b3f6f28175eaf7ff0aef06c25ef990cbccd85aa2a6457468a766b7baea1bd5066690d
SSDEEP

768:W7BlpppARFbhjbhg42Lcfr7BlpppARFbhjbhg42Lcf1r6:W7ZppApBULcfr7ZppApBULcf1r6

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  bc2f5685c028885d2db06daa1bc147a0N.exe
- Size
  
  118KB
- MD5
  
  bc2f5685c028885d2db06daa1bc147a0
- SHA1
  
  f3a17c0e28e6656def525a5ee1fcdf93a916853a
- SHA256
  
  353b2124b4fc947a69e0f136f9036155dc5bd16ba7ddced22e0e60c537356175
- SHA512
  
  02575f92c84beb99967551ae1f288dedf8394365621491af57e234864d0b3f6f28175eaf7ff0aef06c25ef990cbccd85aa2a6457468a766b7baea1bd5066690d
- SSDEEP
  
  768:W7BlpppARFbhjbhg42Lcfr7BlpppARFbhjbhg42Lcf1r6:W7ZppApBULcfr7ZppApBULcf1r6
Score

9^/10

discovery ransomware
- Renames multiple (4357) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware