d5bccc9160adad0a89c05396837144e542f975c72a39cf94be27e5393a7101bf | Triage

Sharing

General

Target

d5bccc9160adad0a89c05396837144e542f975c72a39cf94be27e5393a7101bf
Size

148KB
Sample

221123-k2yr3aaa38
MD5

7c2943a27fa8a7eb008f23a012e2417a
SHA1

5a13018bdd5578367841091d7d438dd825cb76c5
SHA256

d5bccc9160adad0a89c05396837144e542f975c72a39cf94be27e5393a7101bf
SHA512

d8293cdf5a2c293b4be3b84596fa5144becb536c746024e9073f01afc37c27b8d4ec5bc4057fa85c7ad4fea3a2a21d17377b3247666c1fc9c29bf1ba20fea0d8
SSDEEP

1536:CpRZDY5HmunFKtcDrNoLiD3Fvvow149Tlj5CjEhBQ79aXNJ8PcO1zcA7GCBjv4BE:qvY53r9DFHN149d5CgBQJadJXOh7j0E

Score

9^/10

persistence ransomware

Malware Config

Targets

- Target
  
  d5bccc9160adad0a89c05396837144e542f975c72a39cf94be27e5393a7101bf
- Size
  
  148KB
- MD5
  
  7c2943a27fa8a7eb008f23a012e2417a
- SHA1
  
  5a13018bdd5578367841091d7d438dd825cb76c5
- SHA256
  
  d5bccc9160adad0a89c05396837144e542f975c72a39cf94be27e5393a7101bf
- SHA512
  
  d8293cdf5a2c293b4be3b84596fa5144becb536c746024e9073f01afc37c27b8d4ec5bc4057fa85c7ad4fea3a2a21d17377b3247666c1fc9c29bf1ba20fea0d8
- SSDEEP
  
  1536:CpRZDY5HmunFKtcDrNoLiD3Fvvow149Tlj5CjEhBQ79aXNJ8PcO1zcA7GCBjv4BE:qvY53r9DFHN149d5CgBQJadJXOh7j0E
Score

9^/10

persistence ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

persistenceransomware

behavioral2