cda22aa74b025e459bd6404d702331e55bffba5929d7b2bd9f1285330d37ff2a | Triage

Sharing

General

Target

cda22aa74b025e459bd6404d702331e55bffba5929d7b2bd9f1285330d37ff2a
Size

446KB
Sample

221123-tb1cmsdf33
MD5

2cca32c4cf7dc6d10a2462fa9b74ae40
SHA1

74f0125e8e0526b0e465d16668884006a4ee774a
SHA256

cda22aa74b025e459bd6404d702331e55bffba5929d7b2bd9f1285330d37ff2a
SHA512

9b07fff4eb1a6b7dcbb86815bd2aa098748c631b36baf4ab437b9f3b643e8bfb8b2b87884dc548da719739022f57413fcbdb1f2b1409abc3bf0c5827b186af1f
SSDEEP

6144:veoxeLzWoeEqagVXy5LhT57AZT//s7m6Cu8haJ1y6ded:3xeHWohxht7y3sqxTg1yNd

Score

9^/10

collection evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  cda22aa74b025e459bd6404d702331e55bffba5929d7b2bd9f1285330d37ff2a
- Size
  
  446KB
- MD5
  
  2cca32c4cf7dc6d10a2462fa9b74ae40
- SHA1
  
  74f0125e8e0526b0e465d16668884006a4ee774a
- SHA256
  
  cda22aa74b025e459bd6404d702331e55bffba5929d7b2bd9f1285330d37ff2a
- SHA512
  
  9b07fff4eb1a6b7dcbb86815bd2aa098748c631b36baf4ab437b9f3b643e8bfb8b2b87884dc548da719739022f57413fcbdb1f2b1409abc3bf0c5827b186af1f
- SSDEEP
  
  6144:veoxeLzWoeEqagVXy5LhT57AZT//s7m6Cu8haJ1y6ded:3xeHWohxht7y3sqxTg1yNd
Score

9^/10

collection evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Email Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

collectionevasionpersistenceransomwaretrojan

behavioral2