fbc55a603c1daf716b2b12c2074c694afb73979f8a266b763301e2e42230edfd | Triage

Sharing

General

Target

fbc55a603c1daf716b2b12c2074c694afb73979f8a266b763301e2e42230edfd.sample
Size

446KB
Sample

210726-4mhmljjhds
MD5

d781e9d11bd90edc0a29f379e56e39e1
SHA1

d2fc29b258e8307a219ba33c3cbbbef4959055b3
SHA256

fbc55a603c1daf716b2b12c2074c694afb73979f8a266b763301e2e42230edfd
SHA512

55c50e1ac3f77c36995d2753ee64c03dad21720e40bff1e460317cdb965a13c25780f3154d5d49e2e6aea5777a905f442e0e13b6b2489dad3f987064137d137e

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  fbc55a603c1daf716b2b12c2074c694afb73979f8a266b763301e2e42230edfd.sample
- Size
  
  446KB
- MD5
  
  d781e9d11bd90edc0a29f379e56e39e1
- SHA1
  
  d2fc29b258e8307a219ba33c3cbbbef4959055b3
- SHA256
  
  fbc55a603c1daf716b2b12c2074c694afb73979f8a266b763301e2e42230edfd
- SHA512
  
  55c50e1ac3f77c36995d2753ee64c03dad21720e40bff1e460317cdb965a13c25780f3154d5d49e2e6aea5777a905f442e0e13b6b2489dad3f987064137d137e
Score

9^/10

evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaretrojan

behavioral2

evasionpersistenceransomwaretrojan