f8c6d812a9bb8145a866b3f2abc677246f755b026a4291ee78d4da11daded3ec | Triage

Sharing

General

Target

5136db1f08e0e35521a2043b516cff00N.exe
Size

92KB
Sample

240905-psklas1hkd
MD5

5136db1f08e0e35521a2043b516cff00
SHA1

d82ddce390c1fb954f29896aa76bbfae1717978d
SHA256

f8c6d812a9bb8145a866b3f2abc677246f755b026a4291ee78d4da11daded3ec
SHA512

79308ed2162a0d56d67d31cb5aa2e3313df297673d4f013a7b91642cd188d6afdc43faa942d7c8db5d98e6b359f46b6bf861a9aa4f0eb69a4920f9e8a1e43300
SSDEEP

1536:W7ZppApBULcfpHLcfpyDUdyGdyE37ZppApBULcfpHLcfpyDUdyGdyEZ:6pWpBwchcwDq1pWpBwchcwDqZ

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  5136db1f08e0e35521a2043b516cff00N.exe
- Size
  
  92KB
- MD5
  
  5136db1f08e0e35521a2043b516cff00
- SHA1
  
  d82ddce390c1fb954f29896aa76bbfae1717978d
- SHA256
  
  f8c6d812a9bb8145a866b3f2abc677246f755b026a4291ee78d4da11daded3ec
- SHA512
  
  79308ed2162a0d56d67d31cb5aa2e3313df297673d4f013a7b91642cd188d6afdc43faa942d7c8db5d98e6b359f46b6bf861a9aa4f0eb69a4920f9e8a1e43300
- SSDEEP
  
  1536:W7ZppApBULcfpHLcfpyDUdyGdyE37ZppApBULcfpHLcfpyDUdyGdyEZ:6pWpBwchcwDq1pWpBwchcwDqZ
Score

9^/10

discovery ransomware
- Renames multiple (4701) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware