285b6d1269dcee9e2a29e6fdc1e6529c56a84cca3f7ebb76d7e67f02d82382e9 | Triage

Sharing

General

Target

285b6d1269dcee9e2a29e6fdc1e6529c56a84cca3f7ebb76d7e67f02d82382e9N
Size

90KB
Sample

240921-vk4l4atbjg
MD5

8809fb2c1a69174a99fff7007f9e9870
SHA1

f7c402470fef63c1552bd1f03b366ddb8804f40a
SHA256

285b6d1269dcee9e2a29e6fdc1e6529c56a84cca3f7ebb76d7e67f02d82382e9
SHA512

37eaa958d22249b31489db6c1c12bf85260d493f2996f42c999f8b0802be47cb81c739b5ec75cd304206e59bd7bd0055567ce3256c545a8de34b38c6bae440ea
SSDEEP

1536:W7ZppApBULcfpHLcfpyDv7ZppApBULcfpHLcfpyDz+Zf+Zs:6pWpBwchcwDtpWpBwchcwD4

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  285b6d1269dcee9e2a29e6fdc1e6529c56a84cca3f7ebb76d7e67f02d82382e9N
- Size
  
  90KB
- MD5
  
  8809fb2c1a69174a99fff7007f9e9870
- SHA1
  
  f7c402470fef63c1552bd1f03b366ddb8804f40a
- SHA256
  
  285b6d1269dcee9e2a29e6fdc1e6529c56a84cca3f7ebb76d7e67f02d82382e9
- SHA512
  
  37eaa958d22249b31489db6c1c12bf85260d493f2996f42c999f8b0802be47cb81c739b5ec75cd304206e59bd7bd0055567ce3256c545a8de34b38c6bae440ea
- SSDEEP
  
  1536:W7ZppApBULcfpHLcfpyDv7ZppApBULcfpHLcfpyDz+Zf+Zs:6pWpBwchcwDtpWpBwchcwD4
Score

9^/10

discovery ransomware
- Renames multiple (4740) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware