71d2fab2c817895449c1d831b48b4e874281842872934084d85904cc05ccde6d | Triage

Sharing

General

Target

71d2fab2c817895449c1d831b48b4e874281842872934084d85904cc05ccde6d
Size

85KB
Sample

221122-w984jsge9y
MD5

e04cd7ae677dc2feb39801084a880e5c
SHA1

9d3dedf2ab0bbf75debe4ae0f3f7db605ad69657
SHA256

71d2fab2c817895449c1d831b48b4e874281842872934084d85904cc05ccde6d
SHA512

a7b4b67b5accdb8086ca6976adf46117507d91ddc563a057bcce100b2d4b6e7c44717ab359cd63140c275241c0e11fbf5804161f28f8fea30c59ae4cf7e4da07
SSDEEP

1536:G2gJgh/EtOdzY7TSddHhrEGJFAUbcL2pIysWjcdwUdrdgUFk:GF3QYHSdVhFzwAQxdrq6k

Score

10^/10

evasion persistence ransomware

Malware Config

Targets

- Target
  
  71d2fab2c817895449c1d831b48b4e874281842872934084d85904cc05ccde6d
- Size
  
  85KB
- MD5
  
  e04cd7ae677dc2feb39801084a880e5c
- SHA1
  
  9d3dedf2ab0bbf75debe4ae0f3f7db605ad69657
- SHA256
  
  71d2fab2c817895449c1d831b48b4e874281842872934084d85904cc05ccde6d
- SHA512
  
  a7b4b67b5accdb8086ca6976adf46117507d91ddc563a057bcce100b2d4b6e7c44717ab359cd63140c275241c0e11fbf5804161f28f8fea30c59ae4cf7e4da07
- SSDEEP
  
  1536:G2gJgh/EtOdzY7TSddHhrEGJFAUbcL2pIysWjcdwUdrdgUFk:GF3QYHSdVhFzwAQxdrq6k
Score

10^/10

evasion persistence ransomware
- Modifies WinLogon for persistence
  persistence
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomware

behavioral2

evasionpersistenceransomware