115f0cc2a610f0d487b0a8db88bac5649f7d2db36560817f90172a97b637bdab | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6eaa93a2377f0c377d43c001d446de40N
Size

176KB
Sample

240914-fcqmyaxfrd
MD5

6eaa93a2377f0c377d43c001d446de40
SHA1

c032e4ecaf24f18c46047ea5148dd049de970bb8
SHA256

115f0cc2a610f0d487b0a8db88bac5649f7d2db36560817f90172a97b637bdab
SHA512

a7571bc6fa4ca9092954093907430d519bfbb04aa62f1ccab2186b4492eb1371c0656e242a7ac30b331a385088fcf61fd6a96df3c0fe17212b2172887249c151
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eBSWSY/e7WpMaxeb0CYJ97lEYNR73e+eBSWSYa:RqKvb0CYJ973e+eBS5qKvb0CYJ973e+3

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  6eaa93a2377f0c377d43c001d446de40N
- Size
  
  176KB
- MD5
  
  6eaa93a2377f0c377d43c001d446de40
- SHA1
  
  c032e4ecaf24f18c46047ea5148dd049de970bb8
- SHA256
  
  115f0cc2a610f0d487b0a8db88bac5649f7d2db36560817f90172a97b637bdab
- SHA512
  
  a7571bc6fa4ca9092954093907430d519bfbb04aa62f1ccab2186b4492eb1371c0656e242a7ac30b331a385088fcf61fd6a96df3c0fe17212b2172887249c151
- SSDEEP
  
  3072:6e7WpMaxeb0CYJ97lEYNR73e+eBSWSY/e7WpMaxeb0CYJ97lEYNR73e+eBSWSYa:RqKvb0CYJ973e+eBS5qKvb0CYJ973e+3
Score

9^/10

discovery ransomware
- Renames multiple (314) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware