bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8 | Triage

Sharing

General

Target

bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8
Size

60KB
Sample

200625-ykwrj3nmz6
MD5

0ed2ca539a01cdb86c88a9a1604b2005
SHA1

4fed7eae00bfa21938e49f33b7c6794fd7d0750c
SHA256

bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8
SHA512

34dad101cd7c5f9ff2267674d224986b9274e0e17d9ae665ca1af4ffa57408106238b1e248045465ab17c72a4b92473ab3714aefb705d95f9725a4251379c7e2

Score

9^/10

discovery exploit persistence ransomware

Malware Config

Targets

- Target
  
  bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8
- Size
  
  60KB
- MD5
  
  0ed2ca539a01cdb86c88a9a1604b2005
- SHA1
  
  4fed7eae00bfa21938e49f33b7c6794fd7d0750c
- SHA256
  
  bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8
- SHA512
  
  34dad101cd7c5f9ff2267674d224986b9274e0e17d9ae665ca1af4ffa57408106238b1e248045465ab17c72a4b92473ab3714aefb705d95f9725a4251379c7e2
Score

9^/10

persistence discovery exploit ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Possible privilege escalation attempt
  exploit
- Deletes itself
- Loads dropped DLL
- Modifies file permissions
  discovery
- Drops file in System32 directory
- Modifies service
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Modify Existing Service

Privilege Escalation

Defense Evasion

File Deletion

File and Directory Permissions Modification

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

persistencediscoveryexploitransomware

behavioral2

persistencediscoveryexploitransomware