3e7d47574f5d777f7271f8f89ad1f0e8073aa8fa0379219bedf69114677caf67 | Triage

Sharing

General

Target

3e7d47574f5d777f7271f8f89ad1f0e8073aa8fa0379219bedf69114677caf67
Size

554KB
Sample

220520-1fc68sdgh6
MD5

d8e04e51292b7a8f4a04495f8c3c54f0
SHA1

252a4f7798600abace1c718ddee159a0afff7d37
SHA256

3e7d47574f5d777f7271f8f89ad1f0e8073aa8fa0379219bedf69114677caf67
SHA512

55cd6bd3912fea8ec18b597fd612f455276ae8ea8c756b2ae61c13f3e722203fc43b85fdbc572a1e524d8b1207bf785516a5f57cfb15306b6709db414b92fcda

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  3e7d47574f5d777f7271f8f89ad1f0e8073aa8fa0379219bedf69114677caf67
- Size
  
  554KB
- MD5
  
  d8e04e51292b7a8f4a04495f8c3c54f0
- SHA1
  
  252a4f7798600abace1c718ddee159a0afff7d37
- SHA256
  
  3e7d47574f5d777f7271f8f89ad1f0e8073aa8fa0379219bedf69114677caf67
- SHA512
  
  55cd6bd3912fea8ec18b597fd612f455276ae8ea8c756b2ae61c13f3e722203fc43b85fdbc572a1e524d8b1207bf785516a5f57cfb15306b6709db414b92fcda
Score

9^/10

evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaretrojan

behavioral2