ffe5002cc4fce53d2c8114afdc562d1f3089a7f5c20c6afb1ed658b61cb3dc81 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

041fabff366166778afd41e4c57b94f0N.exe
Size

139KB
Sample

240903-ey1jlaybjd
MD5

041fabff366166778afd41e4c57b94f0
SHA1

dec5985d9b1fbc202aaeb22f6b822903fc1a63fd
SHA256

ffe5002cc4fce53d2c8114afdc562d1f3089a7f5c20c6afb1ed658b61cb3dc81
SHA512

b2186abce3d17c6fa5c01b0b9f42b5032cc09372d4f600135de5132dbd328869001ead640b796bc1190563fb064b050acce0eb622f8150b7d788d52e6a4a3bea
SSDEEP

1536:W7ZhA7pApMNcH6gW4Wvs9s2cic8GhGvn+7ZhA7pApMNcH6gW4Wvs9s2cic8GhGv4:6e7WpMNcK9vG1W3e7WpMNcK9vG1WB

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  041fabff366166778afd41e4c57b94f0N.exe
- Size
  
  139KB
- MD5
  
  041fabff366166778afd41e4c57b94f0
- SHA1
  
  dec5985d9b1fbc202aaeb22f6b822903fc1a63fd
- SHA256
  
  ffe5002cc4fce53d2c8114afdc562d1f3089a7f5c20c6afb1ed658b61cb3dc81
- SHA512
  
  b2186abce3d17c6fa5c01b0b9f42b5032cc09372d4f600135de5132dbd328869001ead640b796bc1190563fb064b050acce0eb622f8150b7d788d52e6a4a3bea
- SSDEEP
  
  1536:W7ZhA7pApMNcH6gW4Wvs9s2cic8GhGvn+7ZhA7pApMNcH6gW4Wvs9s2cic8GhGv4:6e7WpMNcK9vG1W3e7WpMNcK9vG1WB
Score

9^/10

discovery ransomware
- Renames multiple (3818) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware