75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2 | Triage

Sharing

General

Target

75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2
Size

554KB
Sample

220520-2lt8dafef7
MD5

7f948cca83d22295814d3235b0b512e4
SHA1

2a6e6e484134cbee198bdf459cb7dcf1bb2378ea
SHA256

75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2
SHA512

58a892c66155f68bc3a9bd11c31e929e0397965c2881f818fb4a32f754031c1ce8cc6938e34cc0c5c7ad2b4b2af6b7778ade9fd5c1ab0a39cf172fdd03611ad0

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2
- Size
  
  554KB
- MD5
  
  7f948cca83d22295814d3235b0b512e4
- SHA1
  
  2a6e6e484134cbee198bdf459cb7dcf1bb2378ea
- SHA256
  
  75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2
- SHA512
  
  58a892c66155f68bc3a9bd11c31e929e0397965c2881f818fb4a32f754031c1ce8cc6938e34cc0c5c7ad2b4b2af6b7778ade9fd5c1ab0a39cf172fdd03611ad0
Score

9^/10

evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaretrojan

behavioral2