6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3 | Triage

Sharing

General

Target

6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe
Size

686KB
Sample

200707-2pajh4g69n
MD5

6a3708ad9f954e3abd920ce364540923
SHA1

3511a35920249c7def2bed50691d011310b76829
SHA256

6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3
SHA512

fa523d6d7acfa01de26ec28944e3fc9da9eda2575fc220207418f396c6583f12e466496290f43ff5cd3d0142f98bfdb6a350890d715b7a3f4c77524913ce205f

Score

10^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe
- Size
  
  686KB
- MD5
  
  6a3708ad9f954e3abd920ce364540923
- SHA1
  
  3511a35920249c7def2bed50691d011310b76829
- SHA256
  
  6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3
- SHA512
  
  fa523d6d7acfa01de26ec28944e3fc9da9eda2575fc220207418f396c6583f12e466496290f43ff5cd3d0142f98bfdb6a350890d715b7a3f4c77524913ce205f
Score

10^/10

persistence evasion trojan ransomware
- UAC bypass
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
- Modifies service
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

File Deletion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

persistenceevasiontrojanransomware

behavioral2

persistenceevasiontrojanransomware