6e251799147552fc32ccb492298385e9e861f0e2cdec9f2afeebc400b124dc68 | Triage

Sharing

General

Target

f72b2edc26402325c29fc0241b0e5b80N
Size

95KB
Sample

240909-cpbsrswhlk
MD5

f72b2edc26402325c29fc0241b0e5b80
SHA1

4b660020557854f698da7bf1a37bf0cbb043c02a
SHA256

6e251799147552fc32ccb492298385e9e861f0e2cdec9f2afeebc400b124dc68
SHA512

e6eb4cc7b170bd61ca14a896cad30834808e461c86adb4e731dcd49d6c92e7f808603afb7153434af9eb808a0d90b919a93caad7f010c8cf78bb6d6a0815b112
SSDEEP

1536:W7ZppApBULcfpHLcfpyDUdyGdyA2X7ZppApBULcfpHLcfpyDUdyGdyA27:6pWpBwchcwDvpWpBwchcwDR

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  f72b2edc26402325c29fc0241b0e5b80N
- Size
  
  95KB
- MD5
  
  f72b2edc26402325c29fc0241b0e5b80
- SHA1
  
  4b660020557854f698da7bf1a37bf0cbb043c02a
- SHA256
  
  6e251799147552fc32ccb492298385e9e861f0e2cdec9f2afeebc400b124dc68
- SHA512
  
  e6eb4cc7b170bd61ca14a896cad30834808e461c86adb4e731dcd49d6c92e7f808603afb7153434af9eb808a0d90b919a93caad7f010c8cf78bb6d6a0815b112
- SSDEEP
  
  1536:W7ZppApBULcfpHLcfpyDUdyGdyA2X7ZppApBULcfpHLcfpyDUdyGdyA27:6pWpBwchcwDvpWpBwchcwDR
Score

9^/10

discovery ransomware
- Renames multiple (4368) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware