c5d1e31d27fcd54f9307f3377818461d30e35e2f09d1730a0dd99b877890ebd2 | Triage

Sharing

General

Target

c5d1e31d27fcd54f9307f3377818461d30e35e2f09d1730a0dd99b877890ebd2N
Size

91KB
Sample

240919-f7fffstbnk
MD5

701e013b21f1c7748a00bdb4395e4cf0
SHA1

4fc9400e0ea497a016b7e7e245935fb4017f75d8
SHA256

c5d1e31d27fcd54f9307f3377818461d30e35e2f09d1730a0dd99b877890ebd2
SHA512

c4985eb8b06afd83ee674b73a8371792f33cd957b3584dbe3b036458d79e49c70f7a77955bbc3886e3d85f4a1d89d2b09a59b9c075f2f0f14136c81ddb2ed55a
SSDEEP

1536:W7ZhA7pApM21LOA1LOrtkpt6Url7ZhA7pApM21LOA1LOrtkpt6UrEBfTBfO:6e7WpMgLOiLOrtQe7WpMgLOiLOrt2

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  c5d1e31d27fcd54f9307f3377818461d30e35e2f09d1730a0dd99b877890ebd2N
- Size
  
  91KB
- MD5
  
  701e013b21f1c7748a00bdb4395e4cf0
- SHA1
  
  4fc9400e0ea497a016b7e7e245935fb4017f75d8
- SHA256
  
  c5d1e31d27fcd54f9307f3377818461d30e35e2f09d1730a0dd99b877890ebd2
- SHA512
  
  c4985eb8b06afd83ee674b73a8371792f33cd957b3584dbe3b036458d79e49c70f7a77955bbc3886e3d85f4a1d89d2b09a59b9c075f2f0f14136c81ddb2ed55a
- SSDEEP
  
  1536:W7ZhA7pApM21LOA1LOrtkpt6Url7ZhA7pApM21LOA1LOrtkpt6UrEBfTBfO:6e7WpMgLOiLOrtQe7WpMgLOiLOrt2
Score

9^/10

discovery ransomware
- Renames multiple (4520) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware