37490db26d2a5b98d16ad0783ecd5f57fec16d3029e6ffc0034d3e199f9d7d84 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

37490db26d2a5b98d16ad0783ecd5f57fec16d3029e6ffc0034d3e199f9d7d84N
Size

79KB
Sample

240918-2ad21swfrm
MD5

26e8ef9c958499060c9a0492895f7ad0
SHA1

8817a765c5c4e6faced049366aa737b14baa0de3
SHA256

37490db26d2a5b98d16ad0783ecd5f57fec16d3029e6ffc0034d3e199f9d7d84
SHA512

5aff3a7b7da4aa7b4a91fc60072329965b45503adef3c647ee4dddb9df780a8f610c6c5136c733584806b36f4c94062863eb9bd686f655f675fb3a8aa915cde6
SSDEEP

1536:W7ZppApBULcfpHLcfpl7ZppApBULcfpHLcfpPCuCs:6pWpBwchcxpWpBwchc8vs

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  37490db26d2a5b98d16ad0783ecd5f57fec16d3029e6ffc0034d3e199f9d7d84N
- Size
  
  79KB
- MD5
  
  26e8ef9c958499060c9a0492895f7ad0
- SHA1
  
  8817a765c5c4e6faced049366aa737b14baa0de3
- SHA256
  
  37490db26d2a5b98d16ad0783ecd5f57fec16d3029e6ffc0034d3e199f9d7d84
- SHA512
  
  5aff3a7b7da4aa7b4a91fc60072329965b45503adef3c647ee4dddb9df780a8f610c6c5136c733584806b36f4c94062863eb9bd686f655f675fb3a8aa915cde6
- SSDEEP
  
  1536:W7ZppApBULcfpHLcfpl7ZppApBULcfpHLcfpPCuCs:6pWpBwchcxpWpBwchc8vs
Score

9^/10

discovery ransomware
- Renames multiple (4656) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware