138c3349b71d2623fa5a0dbbd4daa74bf0b719ef87ade0acaf5101f8e5384b73 | Triage

Sharing

General

Target

138c3349b71d2623fa5a0dbbd4daa74bf0b719ef87ade0acaf5101f8e5384b73N
Size

88KB
Sample

240919-hvzpnswgpp
MD5

9c01e7e86f8340aa04b39f02abfee0c0
SHA1

53d5fcd3d3e29bb378aa5e69ef1f82fc3b0fd89f
SHA256

138c3349b71d2623fa5a0dbbd4daa74bf0b719ef87ade0acaf5101f8e5384b73
SHA512

195b4cbd7dabb35757044410c190a13773cf8c5f9f90715308cfdb05ac25e73bf4ded540dd5cf3593e83c1d9d92d03320a071c5de226b7eb3b22be07e25fa1bc
SSDEEP

1536:W7ZppApBULcfpHLcfpXfxRfx6Od7ZppApBULcfpHLcfpXfxRfx6Okju:6pWpBwchclf7fdpWpBwchclf7f1

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  138c3349b71d2623fa5a0dbbd4daa74bf0b719ef87ade0acaf5101f8e5384b73N
- Size
  
  88KB
- MD5
  
  9c01e7e86f8340aa04b39f02abfee0c0
- SHA1
  
  53d5fcd3d3e29bb378aa5e69ef1f82fc3b0fd89f
- SHA256
  
  138c3349b71d2623fa5a0dbbd4daa74bf0b719ef87ade0acaf5101f8e5384b73
- SHA512
  
  195b4cbd7dabb35757044410c190a13773cf8c5f9f90715308cfdb05ac25e73bf4ded540dd5cf3593e83c1d9d92d03320a071c5de226b7eb3b22be07e25fa1bc
- SSDEEP
  
  1536:W7ZppApBULcfpHLcfpXfxRfx6Od7ZppApBULcfpHLcfpXfxRfx6Okju:6pWpBwchclf7fdpWpBwchclf7f1
Score

9^/10

discovery ransomware
- Renames multiple (4227) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware