e5bafdd9d27defccb5c62db15a0374ccdeedb6a279b33776e8fc1ecb728d70e4 | Triage

Sharing

General

Target

e5bafdd9d27defccb5c62db15a0374ccdeedb6a279b33776e8fc1ecb728d70e4
Size

595KB
Sample

191025-dn8qy4kq5x
MD5

1c1a6b70b5e2b13c019d5cbdf0f12738
SHA1

d21b9d5ca7327bb1ca57aaf8752e7764a3334fe8
SHA256

e5bafdd9d27defccb5c62db15a0374ccdeedb6a279b33776e8fc1ecb728d70e4
SHA512

f6c37079d3f7ae55cfdb1e588830d30bad4b820afc7765c20081a501fe916c6b1b8aa78090801ecb7f3776ae8766987220af5a4eb2639b7d87f56721be7bc675

Score

9^/10

Malware Config

Targets

- Target
  
  e5bafdd9d27defccb5c62db15a0374ccdeedb6a279b33776e8fc1ecb728d70e4
- Size
  
  595KB
- MD5
  
  1c1a6b70b5e2b13c019d5cbdf0f12738
- SHA1
  
  d21b9d5ca7327bb1ca57aaf8752e7764a3334fe8
- SHA256
  
  e5bafdd9d27defccb5c62db15a0374ccdeedb6a279b33776e8fc1ecb728d70e4
- SHA512
  
  f6c37079d3f7ae55cfdb1e588830d30bad4b820afc7765c20081a501fe916c6b1b8aa78090801ecb7f3776ae8766987220af5a4eb2639b7d87f56721be7bc675
Score

9^/10
- Deletes shadow copies
  ransomware
- Deletes itself
- Windows security modification
  evasion trojan
- Checks system information in the registry (likely anti-VM)
- Drops Office document
  dropper exploiter maldoc
- Modifies service
  persistence
- Sets desktop wallpaper using registry
  ransomware
task1 task2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Disabling Security Tools

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Inhibit System Recovery

Tasks

task1

task2