e7859ca1dcde7419306d555c1080e69ed077671c07c0d916656cb966045b07c0 | Triage

Sharing

General

Target

e7859ca1dcde7419306d555c1080e69ed077671c07c0d916656cb966045b07c0
Size

5.4MB
Sample

241120-frgcta1pdz
MD5

fcd957f6c522e305d02ea7242bc975d2
SHA1

6d139140d57e6f02d7352c6d14bb44c8ee2e5832
SHA256

e7859ca1dcde7419306d555c1080e69ed077671c07c0d916656cb966045b07c0
SHA512

a29cdfc6215c918dab47b31de145c508080849ed37eec5579e6eba5f6fea31dea6d275e5bf7190726a432109ef79790b0ed1de3b64b45fb3bb8bec59da51ab8f
SSDEEP

49152:9KgkEaSVK2MtENoFFYHJYgb47QC3GZtp9GY568MNwu4acTC3ZvFXkP5VugzsIYU:8mahrbQEHcTeqqI3

Score

9^/10

discovery persistence ransomware

Malware Config

Targets

- Target
  
  e7859ca1dcde7419306d555c1080e69ed077671c07c0d916656cb966045b07c0
- Size
  
  5.4MB
- MD5
  
  fcd957f6c522e305d02ea7242bc975d2
- SHA1
  
  6d139140d57e6f02d7352c6d14bb44c8ee2e5832
- SHA256
  
  e7859ca1dcde7419306d555c1080e69ed077671c07c0d916656cb966045b07c0
- SHA512
  
  a29cdfc6215c918dab47b31de145c508080849ed37eec5579e6eba5f6fea31dea6d275e5bf7190726a432109ef79790b0ed1de3b64b45fb3bb8bec59da51ab8f
- SSDEEP
  
  49152:9KgkEaSVK2MtENoFFYHJYgb47QC3GZtp9GY568MNwu4acTC3ZvFXkP5VugzsIYU:8mahrbQEHcTeqqI3
Score

9^/10

discovery persistence ransomware
- Renames multiple (317) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistenceransomware