05994c73a4af04ff0cc649273326fa2b4b1a18447c560d58005905ab58b59e84

General

Target
05994c73a4af04ff0cc649273326fa2b4b1a18447c560d58005905ab58b59e84
Size 218KB
Sample260812-qfmessch58
SHA256 05994c73a4af04ff0cc649273326fa2b4b1a18447c560d58005905ab58b59e84
MD5 acf563c9b721f13743b733ad6f20eba5
SHA1 08d90f602268241010e89bec729e01d98a088856
SHA512 a4d2ae78c17e73d738847077343ba9ddbdb6e365e03edb30450899d477a4b44927fe787685b2d1767c972b352f2b2e3334b86021c2b3e7f4c8f6d1add52fadd0
SSDEEP 6144:hD/Xv2yC4xrUOSSS1kwD4miB5SjBmi33ky50IfJg:hDfvdx1S1ko3DoikQ01
TLSH
T12E2423E04FDD0F19A7D3F07B164D8D8A94D19E4780CA984ECA1AF85A6F040DEE3D6329
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  05994c73a4af04ff0cc649273326fa2b4b1a18447c560d58005905ab58b59e84
- Size 218KB
- SHA256 05994c73a4af04ff0cc649273326fa2b4b1a18447c560d58005905ab58b59e84
- MD5 acf563c9b721f13743b733ad6f20eba5
- SHA1 08d90f602268241010e89bec729e01d98a088856
- SHA512 a4d2ae78c17e73d738847077343ba9ddbdb6e365e03edb30450899d477a4b44927fe787685b2d1767c972b352f2b2e3334b86021c2b3e7f4c8f6d1add52fadd0
- SSDEEP 6144:hD/Xv2yC4xrUOSSS1kwD4miB5SjBmi33ky50IfJg:hDfvdx1S1ko3DoikQ01
- TLSH
  T12E2423E04FDD0F19A7D3F07B164D8D8A94D19E4780CA984ECA1AF85A6F040DEE3D6329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  232ad46f353db7bca9d03e88e0c25981447839b221bea99c35f66819f1e17e77.exe
- Size 222KB
- SHA256 232ad46f353db7bca9d03e88e0c25981447839b221bea99c35f66819f1e17e77
- MD5 1c34c1860041aa479c14a9c5b332712c
- SHA1 164866ede63d28354981a2fd2dac8c1d137ce4bd
- SHA512 22272ab0a743b2f77b6a323246d1c0ebc158e213eb52d533fb6997e0c60b9937b211b1fe9f85c69e707b092b541b958f9af7441ddabfb7a558348490db4e0106
- SSDEEP 6144:4VTORriIAgIJ5r9H3hy1VEjmG4EMfTyr0esrcZ:QCRYgIJJ9Xhy84EIUsre
- TLSH
  T18824130EEA28F4ACE03A543B8392D3DD69B53D510210167E1BC5BA8DC73A7606FD5362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

execution ransomware ransowmware
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Command and Scripting Interpreter: PowerShell
  Run Powershell command to delete shadowcopy.
  execution ransowmware
behavioral3 behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Process spawned unexpected child process

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4