69cba8a42da256c9a6dbaac12513174b2b6150c2e703ffc519caaa8bbe01d5fb | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f5a781493d07179a7a9a2aafe7392c80N.exe
Size

91KB
Sample

240906-a3fmrswhmr
MD5

f5a781493d07179a7a9a2aafe7392c80
SHA1

1226beeb77565c4ebeafef09e2510a3459574080
SHA256

69cba8a42da256c9a6dbaac12513174b2b6150c2e703ffc519caaa8bbe01d5fb
SHA512

824f6a1e10f982398dfd5c5c430def9cd41e622b7fd426ba1999fc6a27a34e4b9283a7fb27ef69a01c2d954aee447e3c89780cb029b8299efd7d93fd5a894c53
SSDEEP

768:W7BlpppARFbhjbhPKueKudLw1DQporiQporP7BlpppARFbhjbhPKueKudLw1DQpK:W7ZppApB7pr2rP7ZppApB7pr2rEr1

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  f5a781493d07179a7a9a2aafe7392c80N.exe
- Size
  
  91KB
- MD5
  
  f5a781493d07179a7a9a2aafe7392c80
- SHA1
  
  1226beeb77565c4ebeafef09e2510a3459574080
- SHA256
  
  69cba8a42da256c9a6dbaac12513174b2b6150c2e703ffc519caaa8bbe01d5fb
- SHA512
  
  824f6a1e10f982398dfd5c5c430def9cd41e622b7fd426ba1999fc6a27a34e4b9283a7fb27ef69a01c2d954aee447e3c89780cb029b8299efd7d93fd5a894c53
- SSDEEP
  
  768:W7BlpppARFbhjbhPKueKudLw1DQporiQporP7BlpppARFbhjbhPKueKudLw1DQpK:W7ZppApB7pr2rP7ZppApB7pr2rEr1
Score

9^/10

discovery ransomware
- Renames multiple (4532) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware