6355e160a90ddd3b843dfd0d8c4bdf56cd37a86d3fa955ed0f9cac8d6d68a003 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7fe79132b83ff65e6d9bfbc4b8905950N.exe
Size

166KB
Sample

240823-xf8flasemj
MD5

7fe79132b83ff65e6d9bfbc4b8905950
SHA1

314f5a346f131e3514ddc52919d542febd1ff915
SHA256

6355e160a90ddd3b843dfd0d8c4bdf56cd37a86d3fa955ed0f9cac8d6d68a003
SHA512

edc08564d350cad5dd25f0cf58cd247c0242fd7e54d43938a929ce41ea5392b2ba5843189c4c67d131b7cb7f8046b4629f3082a6fcda9187ee1ae0247ec29779
SSDEEP

3072:9QWpze+eJfFpsJOfFpsJ5D7W4QWpze+eJfFpsJOfFpsJ5D7We:Lpe+ewD1pe+ewDJ

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  7fe79132b83ff65e6d9bfbc4b8905950N.exe
- Size
  
  166KB
- MD5
  
  7fe79132b83ff65e6d9bfbc4b8905950
- SHA1
  
  314f5a346f131e3514ddc52919d542febd1ff915
- SHA256
  
  6355e160a90ddd3b843dfd0d8c4bdf56cd37a86d3fa955ed0f9cac8d6d68a003
- SHA512
  
  edc08564d350cad5dd25f0cf58cd247c0242fd7e54d43938a929ce41ea5392b2ba5843189c4c67d131b7cb7f8046b4629f3082a6fcda9187ee1ae0247ec29779
- SSDEEP
  
  3072:9QWpze+eJfFpsJOfFpsJ5D7W4QWpze+eJfFpsJOfFpsJ5D7We:Lpe+ewD1pe+ewDJ
Score

9^/10

discovery ransomware
- Renames multiple (3994) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware