d13fc435527d1db87f03f96cb0ea9c7c5f6b0e8bd29e0aeb52d282e10bd1ea1b | Triage

Sharing

General

Target

6dada17299e0f36f7b35037753a06100N
Size

195KB
Sample

240909-m7r8ksxbjd
MD5

6dada17299e0f36f7b35037753a06100
SHA1

b2a84c103160c3fdfccf20c91ac886e52b7bec76
SHA256

d13fc435527d1db87f03f96cb0ea9c7c5f6b0e8bd29e0aeb52d282e10bd1ea1b
SHA512

f5dfb8ed513fda79074f138a56294c2b9182eef287f0ab61d6bf683ce81501c5d4f05d10b6ec9decc250796645b77c580ba1fd563f4cdd78948f185ec754b12a
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBa:PqFF2Ie+efYqFF2Ie+efs

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  6dada17299e0f36f7b35037753a06100N
- Size
  
  195KB
- MD5
  
  6dada17299e0f36f7b35037753a06100
- SHA1
  
  b2a84c103160c3fdfccf20c91ac886e52b7bec76
- SHA256
  
  d13fc435527d1db87f03f96cb0ea9c7c5f6b0e8bd29e0aeb52d282e10bd1ea1b
- SHA512
  
  f5dfb8ed513fda79074f138a56294c2b9182eef287f0ab61d6bf683ce81501c5d4f05d10b6ec9decc250796645b77c580ba1fd563f4cdd78948f185ec754b12a
- SSDEEP
  
  3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBa:PqFF2Ie+efYqFF2Ie+efs
Score

9^/10

discovery ransomware
- Renames multiple (3092) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware