3505bc92994bc33ab71bfb458177e0b8c34c7d9aed7d75f23df261d08417a168 | Triage

Sharing

General

Target

8897db876553f942b2eb4005f8475a232bafb82a50ca7761a621842e894a3d80.bin.gz
Size

56KB
Sample

200626-dmckdg1rd2
MD5

0d244295a43bf3b705514e52415a1e64
SHA1

722ac8d7dc788ae97a1eea66c2e80238c926dede
SHA256

3505bc92994bc33ab71bfb458177e0b8c34c7d9aed7d75f23df261d08417a168
SHA512

eff3b90bb6281a0616c4f100970e33483b86dc56846d68e2d4d0673c4b9aeb1d53413ea6901a526af4af5a265903d2ab3db1b084ba4d726635bce2d6357cd21f

Score

9^/10

discovery exploit persistence ransomware

Malware Config

Targets

- Target
  
  sample
- Size
  
  56KB
- MD5
  
  ecb00e9a61f99a7d4c90723294986bbc
- SHA1
  
  be59c867da75e2a66b8c2519e950254f817cd4ad
- SHA256
  
  8897db876553f942b2eb4005f8475a232bafb82a50ca7761a621842e894a3d80
- SHA512
  
  9dee79827d865de41a63962b419eed7e1f9610ff27f00f8b7b2b9f51e905d5db907d310da590d8f1a11ac88e549373edf39bffdb44d1b205728f1b5e0a43aa5e
Score

9^/10

discovery exploit ransomware persistence
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Possible privilege escalation attempt
  exploit
- Deletes itself
- Loads dropped DLL
- Modifies file permissions
  discovery
- Drops file in System32 directory
- Modifies service
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Hidden Files and Directories

Privilege Escalation

Defense Evasion

File Deletion

File Permissions Modification

Modify Registry

Hidden Files and Directories

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

discoveryexploitransomwarepersistence

behavioral2

ransomwarepersistencediscoveryexploit