Overview

overview

9

Static

static

75f2358e8d...b2.exe

windows7_x64

9

75f2358e8d...b2.exe

windows10-2004_x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2

  • Size

    554KB

  • Sample

    220520-2lt8dafef7

  • MD5

    7f948cca83d22295814d3235b0b512e4

  • SHA1

    2a6e6e484134cbee198bdf459cb7dcf1bb2378ea

  • SHA256

    75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2

  • SHA512

    58a892c66155f68bc3a9bd11c31e929e0397965c2881f818fb4a32f754031c1ce8cc6938e34cc0c5c7ad2b4b2af6b7778ade9fd5c1ab0a39cf172fdd03611ad0

Score
9/10
evasionpersistenceransomwaretrojan

Malware Config

Targets

    • Target

      75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2

    • Size

      554KB

    • MD5

      7f948cca83d22295814d3235b0b512e4

    • SHA1

      2a6e6e484134cbee198bdf459cb7dcf1bb2378ea

    • SHA256

      75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2

    • SHA512

      58a892c66155f68bc3a9bd11c31e929e0397965c2881f818fb4a32f754031c1ce8cc6938e34cc0c5c7ad2b4b2af6b7778ade9fd5c1ab0a39cf172fdd03611ad0

    Score
    9/10
    evasionpersistenceransomwaretrojan

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

File Deletion

2
T1107

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Tasks