a4a2863f408c8a655e0d771650547613f1e694a71c5636a174806f66fe28d42f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

556025428f42976d78a243701bb4bcb0N.exe
Size

184KB
Sample

240829-fvxtzaxcjr
MD5

556025428f42976d78a243701bb4bcb0
SHA1

3570b4175119c34a488ddfddd5f46022c4267b65
SHA256

a4a2863f408c8a655e0d771650547613f1e694a71c5636a174806f66fe28d42f
SHA512

5b01502c21d3cc8a73fe87c67efb120c8a04168238c77d41aee1c6411af97027026951c9366b69f08e423f59bcbd2b760d91ac96eea8c1f3a6121980fde8e2d3
SSDEEP

3072:6NLWpCZIzjwHwyTcfWVP2LVP2ZQPNLWpCZIzjwHwyTcfWVP2LVP2ZQ5:u6HWVOVWw6HWVOVWC

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  556025428f42976d78a243701bb4bcb0N.exe
- Size
  
  184KB
- MD5
  
  556025428f42976d78a243701bb4bcb0
- SHA1
  
  3570b4175119c34a488ddfddd5f46022c4267b65
- SHA256
  
  a4a2863f408c8a655e0d771650547613f1e694a71c5636a174806f66fe28d42f
- SHA512
  
  5b01502c21d3cc8a73fe87c67efb120c8a04168238c77d41aee1c6411af97027026951c9366b69f08e423f59bcbd2b760d91ac96eea8c1f3a6121980fde8e2d3
- SSDEEP
  
  3072:6NLWpCZIzjwHwyTcfWVP2LVP2ZQPNLWpCZIzjwHwyTcfWVP2LVP2ZQ5:u6HWVOVWw6HWVOVWC
Score

9^/10

discovery ransomware
- Renames multiple (3449) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware