ecfb3849674edbac8b16550a5bacc1ef4bfb86fc4def3b6bbbcae53036ab9a08 | Triage

Sharing

General

Target

ecfb3849674edbac8b16550a5bacc1ef4bfb86fc4def3b6bbbcae53036ab9a08
Size

186KB
Sample

240919-dm9sfsyalj
MD5

6b729af18863a5322f0f238bc11990e4
SHA1

b4f3b9a255ba03f13dc2fc283d6dd4d30b3ee636
SHA256

ecfb3849674edbac8b16550a5bacc1ef4bfb86fc4def3b6bbbcae53036ab9a08
SHA512

0e5dfab75c670b4f18fd1c42772acfb6e5c3c069c0b349d8c3478046d6e49b8f41dc9c0bbeed80cece6e937514063fe806621cec4e890c0885bbdbcf99ea79ca
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBF:PqFF2Ie+efsL1UabUavqFF2Ie+efsL1O

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  ecfb3849674edbac8b16550a5bacc1ef4bfb86fc4def3b6bbbcae53036ab9a08
- Size
  
  186KB
- MD5
  
  6b729af18863a5322f0f238bc11990e4
- SHA1
  
  b4f3b9a255ba03f13dc2fc283d6dd4d30b3ee636
- SHA256
  
  ecfb3849674edbac8b16550a5bacc1ef4bfb86fc4def3b6bbbcae53036ab9a08
- SHA512
  
  0e5dfab75c670b4f18fd1c42772acfb6e5c3c069c0b349d8c3478046d6e49b8f41dc9c0bbeed80cece6e937514063fe806621cec4e890c0885bbdbcf99ea79ca
- SSDEEP
  
  3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBF:PqFF2Ie+efsL1UabUavqFF2Ie+efsL1O
Score

9^/10

discovery ransomware
- Renames multiple (4048) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware