7e2a27c681b7c250728c380c6e10f93bb24ea32e520950c72c99e6e1a1e1e117 | Triage

Sharing

General

Target

7e2a27c681b7c250728c380c6e10f93bb24ea32e520950c72c99e6e1a1e1e117.sample
Size

188KB
Sample

210726-mhnbzrfene
MD5

a82e96c0fa347c803e4a2e5d95f81340
SHA1

9917bf4ebd86a163d9b63e3761bab9264f8e1d89
SHA256

7e2a27c681b7c250728c380c6e10f93bb24ea32e520950c72c99e6e1a1e1e117
SHA512

e5fcd6cd5876dc93786a6c0b5f855381194795ccb5a990649e3564c5a7b01477716ef1dd0348c81e0bcf361efbfee2d89098eaeb1eb0980f5cb8e7b2b4d5e347

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  7e2a27c681b7c250728c380c6e10f93bb24ea32e520950c72c99e6e1a1e1e117.sample
- Size
  
  188KB
- MD5
  
  a82e96c0fa347c803e4a2e5d95f81340
- SHA1
  
  9917bf4ebd86a163d9b63e3761bab9264f8e1d89
- SHA256
  
  7e2a27c681b7c250728c380c6e10f93bb24ea32e520950c72c99e6e1a1e1e117
- SHA512
  
  e5fcd6cd5876dc93786a6c0b5f855381194795ccb5a990649e3564c5a7b01477716ef1dd0348c81e0bcf361efbfee2d89098eaeb1eb0980f5cb8e7b2b4d5e347
Score

9^/10

evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaretrojan

behavioral2

evasionpersistenceransomwaretrojan