bc2a2d5bd7fe80204e98c55036a20c4dd7152fa2a08ad7697c024e7e19104c12 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ae98e333cd0364ce4df5b98706718290N.exe
Size

97KB
Sample

240820-g6c5da1dmr
MD5

ae98e333cd0364ce4df5b98706718290
SHA1

158e0c253c9e92825ac790cbfa6e16e89e3f45f5
SHA256

bc2a2d5bd7fe80204e98c55036a20c4dd7152fa2a08ad7697c024e7e19104c12
SHA512

e9e53a045dbd033fcc3f6ed942911df1fa5a5a1fe71edb5df6c7058e30331db8b5a8354ae1516b926f6bf53524d4eef4bb3999ae36e84f422eaf2ba85951222a
SSDEEP

3072:9QWpdEKxVTLJtxoVz8FUDrYYaCusjdEKxVTLJtxoVz8FUDrYYaCusjiQWpdEKxV3:Leb

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  ae98e333cd0364ce4df5b98706718290N.exe
- Size
  
  97KB
- MD5
  
  ae98e333cd0364ce4df5b98706718290
- SHA1
  
  158e0c253c9e92825ac790cbfa6e16e89e3f45f5
- SHA256
  
  bc2a2d5bd7fe80204e98c55036a20c4dd7152fa2a08ad7697c024e7e19104c12
- SHA512
  
  e9e53a045dbd033fcc3f6ed942911df1fa5a5a1fe71edb5df6c7058e30331db8b5a8354ae1516b926f6bf53524d4eef4bb3999ae36e84f422eaf2ba85951222a
- SSDEEP
  
  3072:9QWpdEKxVTLJtxoVz8FUDrYYaCusjdEKxVTLJtxoVz8FUDrYYaCusjiQWpdEKxV3:Leb
Score

9^/10

discovery ransomware
- Renames multiple (4449) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware