12b4fbec00ab2e59494bab33538a346891e3323f9d960a667971ad1a68f24e60 | Triage

Sharing

General

Target

5238fcdfd9177a36228a292356a2dc70N.exe
Size

144KB
Sample

240822-w2m64stepr
MD5

5238fcdfd9177a36228a292356a2dc70
SHA1

bf3eaabb239dbd9393271cd5e3d07d07a7286716
SHA256

12b4fbec00ab2e59494bab33538a346891e3323f9d960a667971ad1a68f24e60
SHA512

d1ca482068cf2c24e27cb10b0dd409453a9ea243f393e30f9f69bf9dd98c0c394fe2ead9a2e3c2ab71cd9a33ae07b21a5a04ef3b57be259b240a7b173f082b30
SSDEEP

1536:W7ZppApwEwnmJARJAaXxXNJdkCKPuJdkCKPE7ZppApwEwnmJARJAaXxXNJdkCKPG:6pWpUnDXxXLpWpUnDXxXD

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  5238fcdfd9177a36228a292356a2dc70N.exe
- Size
  
  144KB
- MD5
  
  5238fcdfd9177a36228a292356a2dc70
- SHA1
  
  bf3eaabb239dbd9393271cd5e3d07d07a7286716
- SHA256
  
  12b4fbec00ab2e59494bab33538a346891e3323f9d960a667971ad1a68f24e60
- SHA512
  
  d1ca482068cf2c24e27cb10b0dd409453a9ea243f393e30f9f69bf9dd98c0c394fe2ead9a2e3c2ab71cd9a33ae07b21a5a04ef3b57be259b240a7b173f082b30
- SSDEEP
  
  1536:W7ZppApwEwnmJARJAaXxXNJdkCKPuJdkCKPE7ZppApwEwnmJARJAaXxXNJdkCKPG:6pWpUnDXxXLpWpUnDXxXD
Score

9^/10

discovery ransomware
- Renames multiple (3270) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware