bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8

General
Target

bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8

Size

60KB

Sample

200625-ykwrj3nmz6

Score
9 /10
MD5

0ed2ca539a01cdb86c88a9a1604b2005

SHA1

4fed7eae00bfa21938e49f33b7c6794fd7d0750c

SHA256

bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8

SHA512

34dad101cd7c5f9ff2267674d224986b9274e0e17d9ae665ca1af4ffa57408106238b1e248045465ab17c72a4b92473ab3714aefb705d95f9725a4251379c7e2

Malware Config
Targets
Target

bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8

MD5

0ed2ca539a01cdb86c88a9a1604b2005

Filesize

60KB

Score
9 /10
SHA1

4fed7eae00bfa21938e49f33b7c6794fd7d0750c

SHA256

bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8

SHA512

34dad101cd7c5f9ff2267674d224986b9274e0e17d9ae665ca1af4ffa57408106238b1e248045465ab17c72a4b92473ab3714aefb705d95f9725a4251379c7e2

Tags

Signatures

  • Modifies service

    Tags

    TTPs

    Modify Registry Modify Existing Service
  • Modifies file permissions

    Tags

    TTPs

    File Permissions Modification
  • Possible privilege escalation attempt

    Tags

  • Loads dropped DLL

  • Drops file in System32 directory

  • Deletes shadow copies

    Description

    Ransomware often targets backup files to inhibit system recovery.

    Tags

    TTPs

    File Deletion Inhibit System Recovery
  • Executes dropped EXE

  • Deletes itself

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Discovery
          Execution
            Exfiltration
              Initial Access
                Lateral Movement
                  Privilege Escalation
                    Tasks