bf23d70eecfa1ccd5b25746456dc8c3e0d02daa4f2555f3531289f851a6a4d35 | Triage

Sharing

General

Target

bf222a411f0e59c8d89f08e035371ff0N.exe
Size

112KB
Sample

240824-q8va4svelk
MD5

bf222a411f0e59c8d89f08e035371ff0
SHA1

bc2affdf8fccc273556551715d23a9e3b6a804df
SHA256

bf23d70eecfa1ccd5b25746456dc8c3e0d02daa4f2555f3531289f851a6a4d35
SHA512

6b849497c5bf8c3f01e5484958cb404f1135515a60ad0550c4765f62caa4c9d817dacda56449acd3b41f3ba20bcd643e5107f852061ff258ca4fe57dd2a18733
SSDEEP

768:W7BlpppARFbhFAxC7ntkntV/dwks7BlpppARFbhFAxC7ntkntV/dwk8:W7ZppApryzwks7ZppApryzwk8

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  bf222a411f0e59c8d89f08e035371ff0N.exe
- Size
  
  112KB
- MD5
  
  bf222a411f0e59c8d89f08e035371ff0
- SHA1
  
  bc2affdf8fccc273556551715d23a9e3b6a804df
- SHA256
  
  bf23d70eecfa1ccd5b25746456dc8c3e0d02daa4f2555f3531289f851a6a4d35
- SHA512
  
  6b849497c5bf8c3f01e5484958cb404f1135515a60ad0550c4765f62caa4c9d817dacda56449acd3b41f3ba20bcd643e5107f852061ff258ca4fe57dd2a18733
- SSDEEP
  
  768:W7BlpppARFbhFAxC7ntkntV/dwks7BlpppARFbhFAxC7ntkntV/dwk8:W7ZppApryzwks7ZppApryzwk8
Score

9^/10

discovery ransomware
- Renames multiple (4284) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware