931eb5ae791991f7ace322ce21f3639c060436af7b7376eb28ebbb2f2cf4c833 | Triage

Sharing

General

Target

931eb5ae791991f7ace322ce21f3639c060436af7b7376eb28ebbb2f2cf4c833
Size

554KB
Sample

220521-an74gaaef7
MD5

686b6813e2f24e6e61afe74e9ed1642d
SHA1

cbf55d857f1816056bb2849308c9196e8115b821
SHA256

931eb5ae791991f7ace322ce21f3639c060436af7b7376eb28ebbb2f2cf4c833
SHA512

a67eac318d9947efa6d8dc1919c8026110fd62efd3f0978a5424857349e95287b3b30733be3816efe6c9458d2c35fb12fa6b05b086ffbd7abc4c183663d2fa56

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  931eb5ae791991f7ace322ce21f3639c060436af7b7376eb28ebbb2f2cf4c833
- Size
  
  554KB
- MD5
  
  686b6813e2f24e6e61afe74e9ed1642d
- SHA1
  
  cbf55d857f1816056bb2849308c9196e8115b821
- SHA256
  
  931eb5ae791991f7ace322ce21f3639c060436af7b7376eb28ebbb2f2cf4c833
- SHA512
  
  a67eac318d9947efa6d8dc1919c8026110fd62efd3f0978a5424857349e95287b3b30733be3816efe6c9458d2c35fb12fa6b05b086ffbd7abc4c183663d2fa56
Score

9^/10

evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaretrojan

behavioral2