cf3faa0f9e284562bfe0611ee44e2b7d7c4b75219e40dfacf5af2d00b9abdb8b | Triage

Sharing

General

Target

cf3faa0f9e284562bfe0611ee44e2b7d7c4b75219e40dfacf5af2d00b9abdb8bN
Size

150KB
Sample

241004-jn7x5swfmb
MD5

6cfc5e223ac0cfcdae2b1acef45ef440
SHA1

49e18c39ae1ef42f00ad8fd6ebaf54ac6c81483a
SHA256

cf3faa0f9e284562bfe0611ee44e2b7d7c4b75219e40dfacf5af2d00b9abdb8b
SHA512

74ff1da12d115292e0869a17a601be0746a3161aecec79e2b0bda10c95679cd3778c6fb3dfa80c4a8fe73605a8af849cc2f5f0f56ca87958decdc3caa342c351
SSDEEP

3072:62ssWpcU7lK1lKgkM2ssWpcU7lK1lKgks:MVyU7lK1lKiVyU7lK1lKM

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  cf3faa0f9e284562bfe0611ee44e2b7d7c4b75219e40dfacf5af2d00b9abdb8bN
- Size
  
  150KB
- MD5
  
  6cfc5e223ac0cfcdae2b1acef45ef440
- SHA1
  
  49e18c39ae1ef42f00ad8fd6ebaf54ac6c81483a
- SHA256
  
  cf3faa0f9e284562bfe0611ee44e2b7d7c4b75219e40dfacf5af2d00b9abdb8b
- SHA512
  
  74ff1da12d115292e0869a17a601be0746a3161aecec79e2b0bda10c95679cd3778c6fb3dfa80c4a8fe73605a8af849cc2f5f0f56ca87958decdc3caa342c351
- SSDEEP
  
  3072:62ssWpcU7lK1lKgkM2ssWpcU7lK1lKgks:MVyU7lK1lKiVyU7lK1lKM
Score

9^/10

discovery ransomware
- Renames multiple (3706) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware