6d8754086a69ab05a3ebeedcdcd252d960cca788438fe214b7bf29df011ac0b9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

164b5911d3d42003a4363e273461e2d0N.exe
Size

98KB
Sample

240906-js7g6svgla
MD5

164b5911d3d42003a4363e273461e2d0
SHA1

f340c38211b3e6a6c1e3c0671d86db67ead36545
SHA256

6d8754086a69ab05a3ebeedcdcd252d960cca788438fe214b7bf29df011ac0b9
SHA512

3e721769557a166578deabbd74412b72244d2d21b35df8f3d0831004b7b8e0a00392f4121e46164c17aef37a3763db9dea999ac1c4d5a27635f4eb463ea67146
SSDEEP

768:W7BlpppARFbhbt7Y7wTCg0hcM0hcx7BlpppARFbhbt7Y7wTCg0hcM0hcK:W7ZppApN0hcM0hcx7ZppApN0hcM0hcK

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  164b5911d3d42003a4363e273461e2d0N.exe
- Size
  
  98KB
- MD5
  
  164b5911d3d42003a4363e273461e2d0
- SHA1
  
  f340c38211b3e6a6c1e3c0671d86db67ead36545
- SHA256
  
  6d8754086a69ab05a3ebeedcdcd252d960cca788438fe214b7bf29df011ac0b9
- SHA512
  
  3e721769557a166578deabbd74412b72244d2d21b35df8f3d0831004b7b8e0a00392f4121e46164c17aef37a3763db9dea999ac1c4d5a27635f4eb463ea67146
- SSDEEP
  
  768:W7BlpppARFbhbt7Y7wTCg0hcM0hcx7BlpppARFbhbt7Y7wTCg0hcM0hcK:W7ZppApN0hcM0hcx7ZppApN0hcM0hcK
Score

9^/10

discovery ransomware
- Renames multiple (4593) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware