beac26ba4abbcf3e290ca94b7a28bb9e259ed013b8ce99a6305d0afce9f8bdd3 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e1fd753ce5a76dcdaf8d29dc2869b180N.exe
Size

147KB
Sample

240824-pmpcaszdld
MD5

e1fd753ce5a76dcdaf8d29dc2869b180
SHA1

cc7819d1e9b060d86ceefe55efb724836804a797
SHA256

beac26ba4abbcf3e290ca94b7a28bb9e259ed013b8ce99a6305d0afce9f8bdd3
SHA512

209f1b9afede0f8d2e05dff75536b726f722aecbace9cbda3c710b3e969fb2a835db1d72d2545f0762cc52576b9e5ca7982acbf18d162d23cdbe5b5446bbac81
SSDEEP

3072:9QWpze+eJfFpsJOfFpsJ5DVSWu0SWu1QWpze+eJfFpsJOfFpsJ5DVSWu0SWuX:Lpe+ewDVSWu0SWuDpe+ewDVSWu0SWuX

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  e1fd753ce5a76dcdaf8d29dc2869b180N.exe
- Size
  
  147KB
- MD5
  
  e1fd753ce5a76dcdaf8d29dc2869b180
- SHA1
  
  cc7819d1e9b060d86ceefe55efb724836804a797
- SHA256
  
  beac26ba4abbcf3e290ca94b7a28bb9e259ed013b8ce99a6305d0afce9f8bdd3
- SHA512
  
  209f1b9afede0f8d2e05dff75536b726f722aecbace9cbda3c710b3e969fb2a835db1d72d2545f0762cc52576b9e5ca7982acbf18d162d23cdbe5b5446bbac81
- SSDEEP
  
  3072:9QWpze+eJfFpsJOfFpsJ5DVSWu0SWu1QWpze+eJfFpsJOfFpsJ5DVSWu0SWuX:Lpe+ewDVSWu0SWuDpe+ewDVSWu0SWuX
Score

9^/10

discovery ransomware
- Renames multiple (3285) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware