5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367 | Triage

Sharing

General

Target

5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367
Size

1.0MB
Sample

200625-a7f1nq69h6
MD5

572fea5f025df78f2d316216fbeee52e
SHA1

91b2bf44b1f9282c09f07f16631deaa3ad9d956d
SHA256

5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367
SHA512

eb238272227c5825477ff1e37dc4f7e467665049d4db5649fff59c39d7745e88b06234d6d1218c05c802e33e21577f9d4a533cb9e23ebe6fb09654f97759c187

Score

9^/10

discovery exploit persistence ransomware

Malware Config

Targets

- Target
  
  5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367
- Size
  
  1.0MB
- MD5
  
  572fea5f025df78f2d316216fbeee52e
- SHA1
  
  91b2bf44b1f9282c09f07f16631deaa3ad9d956d
- SHA256
  
  5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367
- SHA512
  
  eb238272227c5825477ff1e37dc4f7e467665049d4db5649fff59c39d7745e88b06234d6d1218c05c802e33e21577f9d4a533cb9e23ebe6fb09654f97759c187
Score

9^/10

ransomware persistence discovery exploit
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Possible privilege escalation attempt
  exploit
- Deletes itself
- Loads dropped DLL
- Modifies file permissions
  discovery
- Drops file in System32 directory
- Modifies service
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Modify Existing Service

Privilege Escalation

Defense Evasion

File Deletion

File and Directory Permissions Modification

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

ransomwarepersistencediscoveryexploit

behavioral2

persistencediscoveryexploitransomware