5ffe686c630f0ae10da015df33a514b927da9d5ef212f3fb6db87409dd3fc6e4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5ffe686c630f0ae10da015df33a514b927da9d5ef212f3fb6db87409dd3fc6e4
Size

175KB
Sample

241013-2pam5ssbqf
MD5

3675247d834d7f11d761b38b6111fe4e
SHA1

def677c6489de7ae879e32b35a1b452a40b9825e
SHA256

5ffe686c630f0ae10da015df33a514b927da9d5ef212f3fb6db87409dd3fc6e4
SHA512

02b0eec1139aa125d08f4171b3a1b475e00607fcfa414ed04708accde6a1b0878c429068c8b7469d8dadcc3ace6c6b5242f4102db90619c7eaef04c15737b4dc
SSDEEP

1536:W7ZDpApYbWjIoPyPoLzV7c6ShWfxRfxMlH7ZDpApYbWjIoPyPoLzV7c6ShWfxRfU:6DWpLf7fWlFDWpLf7fWlFudur

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  
  5ffe686c630f0ae10da015df33a514b927da9d5ef212f3fb6db87409dd3fc6e4
- Size
  
  175KB
- MD5
  
  3675247d834d7f11d761b38b6111fe4e
- SHA1
  
  def677c6489de7ae879e32b35a1b452a40b9825e
- SHA256
  
  5ffe686c630f0ae10da015df33a514b927da9d5ef212f3fb6db87409dd3fc6e4
- SHA512
  
  02b0eec1139aa125d08f4171b3a1b475e00607fcfa414ed04708accde6a1b0878c429068c8b7469d8dadcc3ace6c6b5242f4102db90619c7eaef04c15737b4dc
- SSDEEP
  
  1536:W7ZDpApYbWjIoPyPoLzV7c6ShWfxRfxMlH7ZDpApYbWjIoPyPoLzV7c6ShWfxRfU:6DWpLf7fWlFDWpLf7fWlFudur
Score

9^/10

discovery ransomware
- Renames multiple (4124) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware