475fe56db9b654d0301c150cf48dfcc65e02a798b05d06d1b179785b5bd995b3 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

475fe56db9b654d0301c150cf48dfcc65e02a798b05d06d1b179785b5bd995b3N
Size

89KB
Sample

240927-t44krsthnb
MD5

f69cf17334a49a892b4c30d23b8f4630
SHA1

646e09c82975f52f9661ecde854f662f609f35f6
SHA256

475fe56db9b654d0301c150cf48dfcc65e02a798b05d06d1b179785b5bd995b3
SHA512

7562b8c075d22f32d02d629e483d58abdd828236b001cc154d29d6fac6cdf31e8d41447a6843e8e6f72015c5d527e1f92aad33a3ca2a7c427c104be6150c3b6b
SSDEEP

1536:W7ZppApBULcfpHLcfpyDcdyGdyaY7ZppApBULcfpHLcfpyDcdyGdyaW0IhAFV2RQ:6pWpBwchcwDAYpWpBwchcwDAD+6V2Run

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  475fe56db9b654d0301c150cf48dfcc65e02a798b05d06d1b179785b5bd995b3N
- Size
  
  89KB
- MD5
  
  f69cf17334a49a892b4c30d23b8f4630
- SHA1
  
  646e09c82975f52f9661ecde854f662f609f35f6
- SHA256
  
  475fe56db9b654d0301c150cf48dfcc65e02a798b05d06d1b179785b5bd995b3
- SHA512
  
  7562b8c075d22f32d02d629e483d58abdd828236b001cc154d29d6fac6cdf31e8d41447a6843e8e6f72015c5d527e1f92aad33a3ca2a7c427c104be6150c3b6b
- SSDEEP
  
  1536:W7ZppApBULcfpHLcfpyDcdyGdyaY7ZppApBULcfpHLcfpyDcdyGdyaW0IhAFV2RQ:6pWpBwchcwDAYpWpBwchcwDAD+6V2Run
Score

9^/10

discovery ransomware
- Renames multiple (3600) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware