bef157ad0195cfbd123900f9b23cef0cfb8c3fe7b09ff5aba608b1b2803b1744 | Triage

Sharing

General

Target

bef157ad0195cfbd123900f9b23cef0cfb8c3fe7b09ff5aba608b1b2803b1744N
Size

171KB
Sample

240919-fezzds1gpf
MD5

b81bf4a2c826d43cff8f35ad99a02a40
SHA1

8388724558e223020467902c37e124c4daa58a34
SHA256

bef157ad0195cfbd123900f9b23cef0cfb8c3fe7b09ff5aba608b1b2803b1744
SHA512

c2d85c47524e8913b642a25b7925e3dd1518cee7da0ec562c0371344fad681bcce393fa585f1365ffcd1f1653df670bef39857d1fa5ebab1a1fff9c29d151181
SSDEEP

1536:W7ZhA7dABJJZENTBAOvwdaERm3w0N7ZhA7dABJJZENTBAOvwdaERm3w0af5:6e76BtE2aiUwue76BtE2aiUwl

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  bef157ad0195cfbd123900f9b23cef0cfb8c3fe7b09ff5aba608b1b2803b1744N
- Size
  
  171KB
- MD5
  
  b81bf4a2c826d43cff8f35ad99a02a40
- SHA1
  
  8388724558e223020467902c37e124c4daa58a34
- SHA256
  
  bef157ad0195cfbd123900f9b23cef0cfb8c3fe7b09ff5aba608b1b2803b1744
- SHA512
  
  c2d85c47524e8913b642a25b7925e3dd1518cee7da0ec562c0371344fad681bcce393fa585f1365ffcd1f1653df670bef39857d1fa5ebab1a1fff9c29d151181
- SSDEEP
  
  1536:W7ZhA7dABJJZENTBAOvwdaERm3w0N7ZhA7dABJJZENTBAOvwdaERm3w0af5:6e76BtE2aiUwue76BtE2aiUwl
Score

9^/10

discovery ransomware
- Renames multiple (3185) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware