ff3d9df0ccfdf7c7cc5cfd64f624eeb871e912b9fcc032d081a54e3e1bd1563c | Triage

Sharing

General

Target

ff3d9df0ccfdf7c7cc5cfd64f624eeb871e912b9fcc032d081a54e3e1bd1563c
Size

118KB
Sample

240826-f7d8dsxera
MD5

4bee00f0eba0dc5a9b51ae83bb2424d5
SHA1

55f850fd67c304d6abe52acfa22079181830dd37
SHA256

ff3d9df0ccfdf7c7cc5cfd64f624eeb871e912b9fcc032d081a54e3e1bd1563c
SHA512

cf06ddf8fd8a8247ac0483b64f2fa6cf8b56b6fd6e9c53efa2b87701f3d25efed4c34cb10e38b5441c737019741bcbb00521d0773f227f6b4e44ce83e9fef9d8
SSDEEP

1536:W7ZNLpApCZuvIYXJSpXeXZ7ZNLpApCZuvIYXJSpXeXsN3:6NLWpCZLYZSpuTNLWpCZLYZSpuW

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  ff3d9df0ccfdf7c7cc5cfd64f624eeb871e912b9fcc032d081a54e3e1bd1563c
- Size
  
  118KB
- MD5
  
  4bee00f0eba0dc5a9b51ae83bb2424d5
- SHA1
  
  55f850fd67c304d6abe52acfa22079181830dd37
- SHA256
  
  ff3d9df0ccfdf7c7cc5cfd64f624eeb871e912b9fcc032d081a54e3e1bd1563c
- SHA512
  
  cf06ddf8fd8a8247ac0483b64f2fa6cf8b56b6fd6e9c53efa2b87701f3d25efed4c34cb10e38b5441c737019741bcbb00521d0773f227f6b4e44ce83e9fef9d8
- SSDEEP
  
  1536:W7ZNLpApCZuvIYXJSpXeXZ7ZNLpApCZuvIYXJSpXeXsN3:6NLWpCZLYZSpuTNLWpCZLYZSpuW
Score

9^/10

discovery ransomware
- Renames multiple (4550) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware