a32172b134652404c0d15fa05e304f21aa6584666a1ff0fa49fc3f62a506d557 | Triage

Sharing

General

Target

a32172b134652404c0d15fa05e304f21aa6584666a1ff0fa49fc3f62a506d557.exe
Size

977KB
Sample

241119-w8yles1akp
MD5

616d023a69933b8b314ce406288a8037
SHA1

237dbbd97888e36be1b50a7f25e65fe61ba92fde
SHA256

a32172b134652404c0d15fa05e304f21aa6584666a1ff0fa49fc3f62a506d557
SHA512

869e1f85f11382374ac547517c76e354396d21b39fcf6f04a245288a12c601f4f866497051ee6f59966ef4afb80fa58a7e886ee90af25a579935886bb3d30e9a
SSDEEP

12288:9jFBrB2B7CWnP7y8H+RNUDDvRP77+7qB3DWKtsm45Y:9jLYP/eR0u7C3D1tT45Y

Score

9^/10

discovery persistence ransomware

Malware Config

Targets

- Target
  
  a32172b134652404c0d15fa05e304f21aa6584666a1ff0fa49fc3f62a506d557.exe
- Size
  
  977KB
- MD5
  
  616d023a69933b8b314ce406288a8037
- SHA1
  
  237dbbd97888e36be1b50a7f25e65fe61ba92fde
- SHA256
  
  a32172b134652404c0d15fa05e304f21aa6584666a1ff0fa49fc3f62a506d557
- SHA512
  
  869e1f85f11382374ac547517c76e354396d21b39fcf6f04a245288a12c601f4f866497051ee6f59966ef4afb80fa58a7e886ee90af25a579935886bb3d30e9a
- SSDEEP
  
  12288:9jFBrB2B7CWnP7y8H+RNUDDvRP77+7qB3DWKtsm45Y:9jLYP/eR0u7C3D1tT45Y
Score

9^/10

discovery persistence ransomware
- Renames multiple (316) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistenceransomware