875ddb6faf9740e2a28b6a7b31e5aeab700d824b6bfb5991c092520265c30ff2 | Triage

Sharing

General

Target

5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.zip
Size

76KB
Sample

200626-f8mzdbqazx
MD5

48da6b57c5f4dab612265e6c4734b8fd
SHA1

edd64257d7159bddefa7c540fa0be397c281a529
SHA256

875ddb6faf9740e2a28b6a7b31e5aeab700d824b6bfb5991c092520265c30ff2
SHA512

e360481d41d48a455c2ba7481d8f571d05a10f9dba1e4fc96a21813843d01e147e2499ddfcb51f9e0a0572270109333d2f295f20a496ee4096b2e352b5b8bc90

Score

9^/10

discovery exploit persistence ransomware

Malware Config

Targets

- Target
  
  5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367
- Size
  
  1.0MB
- MD5
  
  572fea5f025df78f2d316216fbeee52e
- SHA1
  
  91b2bf44b1f9282c09f07f16631deaa3ad9d956d
- SHA256
  
  5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367
- SHA512
  
  eb238272227c5825477ff1e37dc4f7e467665049d4db5649fff59c39d7745e88b06234d6d1218c05c802e33e21577f9d4a533cb9e23ebe6fb09654f97759c187
Score

9^/10

ransomware persistence discovery exploit
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Possible privilege escalation attempt
  exploit
- Deletes itself
- Loads dropped DLL
- Modifies file permissions
  discovery
- Drops file in System32 directory
- Modifies service
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Hidden Files and Directories

Privilege Escalation

Defense Evasion

File Deletion

File Permissions Modification

Modify Registry

Hidden Files and Directories

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

ransomwarepersistencediscoveryexploit

behavioral2

persistencediscoveryexploitransomware