a02f96e4105e3b5911a8f539952021389e6c0d07564228e3f38a5faa8641c21a | Triage

Sharing

General

Target

a02f96e4105e3b5911a8f539952021389e6c0d07564228e3f38a5faa8641c21aN
Size

94KB
Sample

240919-hd3p1avgna
MD5

601aed9844262497485ad513bf641f40
SHA1

e60ec283ff357cb6048bf212ff78972c0352de0c
SHA256

a02f96e4105e3b5911a8f539952021389e6c0d07564228e3f38a5faa8641c21a
SHA512

305923784818218f4804b617aa227762ee0d395a75ee9c7e2da03de0e0f937bce62a09a1060bfd7b8139ff19b625de9f02709189f79e00d6452bfe69a20476e5
SSDEEP

768:/7BlpQpARFbhNIZPd7BlpQpARFbhNIZPdQq:/7ZQpAp0Pd7ZQpAp0PdQq

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  a02f96e4105e3b5911a8f539952021389e6c0d07564228e3f38a5faa8641c21aN
- Size
  
  94KB
- MD5
  
  601aed9844262497485ad513bf641f40
- SHA1
  
  e60ec283ff357cb6048bf212ff78972c0352de0c
- SHA256
  
  a02f96e4105e3b5911a8f539952021389e6c0d07564228e3f38a5faa8641c21a
- SHA512
  
  305923784818218f4804b617aa227762ee0d395a75ee9c7e2da03de0e0f937bce62a09a1060bfd7b8139ff19b625de9f02709189f79e00d6452bfe69a20476e5
- SSDEEP
  
  768:/7BlpQpARFbhNIZPd7BlpQpARFbhNIZPdQq:/7ZQpAp0Pd7ZQpAp0PdQq
Score

9^/10

discovery ransomware
- Renames multiple (4932) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware