c3e867c18b88e221ce758f7f08305876ddc14020f60571982e065d9bd153b99d | Triage

Sharing

General

Target

c3e867c18b88e221ce758f7f08305876ddc14020f60571982e065d9bd153b99dN
Size

109KB
Sample

240918-ksbk6ssgnl
MD5

7c41b566449cc3aea864936c828526e0
SHA1

c251c2c2bce60c14839d25f07582c2c85d677e4e
SHA256

c3e867c18b88e221ce758f7f08305876ddc14020f60571982e065d9bd153b99d
SHA512

1c2759aa2c3b1b30096b46db3367d52e8fcc2c9dd71d6c4e14bee32aa29a25daa841d2ad7c8b369f8918c0801de411244d5ba1158eb4a41a6d0b81d64f176920
SSDEEP

768:W7BlpppARFbhHFoqAJwBqAJw1VyjVyfxAkJhxAkJU7AiPWiPBX57BlpppARFbhH6:W7ZppApyVyjVyi7J7ZppApyVyjVyi7q

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  c3e867c18b88e221ce758f7f08305876ddc14020f60571982e065d9bd153b99dN
- Size
  
  109KB
- MD5
  
  7c41b566449cc3aea864936c828526e0
- SHA1
  
  c251c2c2bce60c14839d25f07582c2c85d677e4e
- SHA256
  
  c3e867c18b88e221ce758f7f08305876ddc14020f60571982e065d9bd153b99d
- SHA512
  
  1c2759aa2c3b1b30096b46db3367d52e8fcc2c9dd71d6c4e14bee32aa29a25daa841d2ad7c8b369f8918c0801de411244d5ba1158eb4a41a6d0b81d64f176920
- SSDEEP
  
  768:W7BlpppARFbhHFoqAJwBqAJw1VyjVyfxAkJhxAkJU7AiPWiPBX57BlpppARFbhH6:W7ZppApyVyjVyi7J7ZppApyVyjVyi7q
Score

9^/10

discovery ransomware
- Renames multiple (445) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware