a1dd777b810ac8c0cebb58c620158c5d5744aa1760ae5613cad8e71c1bb77611 | Triage

Sharing

General

Target

a1dd777b810ac8c0cebb58c620158c5d5744aa1760ae5613cad8e71c1bb77611N
Size

112KB
Sample

241006-nqfnwswemh
MD5

927d264e3419ac884358f0320810b5e0
SHA1

ceabbedd0ccc2c4c93bf8821da1c543a00cb40ff
SHA256

a1dd777b810ac8c0cebb58c620158c5d5744aa1760ae5613cad8e71c1bb77611
SHA512

19821f41b7272a605d50cf56aaba446845480405fbc1954332e7badbd5e32382e5fa9e9624402882ca2cd066396cc77f87c903345f5e0865944423d2584c1350
SSDEEP

768:/7BlpQpARFbhvEXBwzEXBwLtAc7Fc777BlpQpARFbhvEXBwzEXBwLtAc7Fc7i:/7ZQpApHo77ZQpApHoi

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  a1dd777b810ac8c0cebb58c620158c5d5744aa1760ae5613cad8e71c1bb77611N
- Size
  
  112KB
- MD5
  
  927d264e3419ac884358f0320810b5e0
- SHA1
  
  ceabbedd0ccc2c4c93bf8821da1c543a00cb40ff
- SHA256
  
  a1dd777b810ac8c0cebb58c620158c5d5744aa1760ae5613cad8e71c1bb77611
- SHA512
  
  19821f41b7272a605d50cf56aaba446845480405fbc1954332e7badbd5e32382e5fa9e9624402882ca2cd066396cc77f87c903345f5e0865944423d2584c1350
- SSDEEP
  
  768:/7BlpQpARFbhvEXBwzEXBwLtAc7Fc777BlpQpARFbhvEXBwzEXBwLtAc7Fc7i:/7ZQpApHo77ZQpApHoi
Score

9^/10

discovery ransomware
- Renames multiple (4270) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware