Overview

overview

9

Static

static

ada5bc7937...e5.exe

windows7_x64

9

ada5bc7937...e5.exe

windows10-2004_x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ada5bc7937720a985b47a2e1ec53034b0f6d37ea0d5c01d551d871980804bce5

  • Size

    554KB

  • Sample

    220520-2tnqkagab9

  • MD5

    5d5a21b34a60312dd1b185c7c3ccc8ac

  • SHA1

    bf9d372b7dc50807b9dddc69aa1c3d4c36d91ed3

  • SHA256

    ada5bc7937720a985b47a2e1ec53034b0f6d37ea0d5c01d551d871980804bce5

  • SHA512

    d423e47189df4c837b4e28315bed2a7ece63b985f995db829dd0fff8e3ea76ecda5d08265b1aa1f91c6566905ad632f461a2076c92db2affb7be1204af57e83b

Score
9/10
evasionpersistenceransomwaretrojan

Malware Config

Targets

    • Target

      ada5bc7937720a985b47a2e1ec53034b0f6d37ea0d5c01d551d871980804bce5

    • Size

      554KB

    • MD5

      5d5a21b34a60312dd1b185c7c3ccc8ac

    • SHA1

      bf9d372b7dc50807b9dddc69aa1c3d4c36d91ed3

    • SHA256

      ada5bc7937720a985b47a2e1ec53034b0f6d37ea0d5c01d551d871980804bce5

    • SHA512

      d423e47189df4c837b4e28315bed2a7ece63b985f995db829dd0fff8e3ea76ecda5d08265b1aa1f91c6566905ad632f461a2076c92db2affb7be1204af57e83b

    Score
    9/10
    evasionpersistenceransomwaretrojan

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

File Deletion

2
T1107

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Tasks