4d3d47fe3d88b6cb5c3dc7712b6f0d948b46f9b1dc6b4415a170d71f7943f556 | Triage

Sharing

General

Target

4d3d47fe3d88b6cb5c3dc7712b6f0d948b46f9b1dc6b4415a170d71f7943f556
Size

287KB
Sample

221124-h88vhabf3t
MD5

bc1cf7a80a21356b81bbf41d153a5d0f
SHA1

bf24d533d95fc1f2397bf3aae638b10de5ffd513
SHA256

4d3d47fe3d88b6cb5c3dc7712b6f0d948b46f9b1dc6b4415a170d71f7943f556
SHA512

82f9505262d320a3e0f7ec4847988ccd8d52b55e7e5746e3e96c8bec4a21afbec2269c5e5565ed0df43124beaf60e11317c52abb515a4f760031a2aa1656b747
SSDEEP

6144:AdsTCKMJBKYHLpBPttGSpqHS60d7BD20C5SaQR82NSXUBy0:AdsMJ7VttpsS60dBDFSURNNSXuz

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  Processing.Pdf____________________________________________________________.exe
- Size
  
  470KB
- MD5
  
  1325ea7384a4653a3a337381cfe180fa
- SHA1
  
  eb2eae4cc2a5c7356b4e00c0f3d44788c4ae27e0
- SHA256
  
  2c6e410c276a53ad9c2f0560604a42bcd487e0d853b6f524b6db278ca112b81d
- SHA512
  
  dcaae00a97123d7d97773bdb52f99ea79c20f8a39a5366195c8fa916c7111f69117a91f259fef0ec7d6f67b7e69f734cfe7058c14696aef94ef4fcd1a0378b3d
- SSDEEP
  
  6144:eicL4qwxpzEuqcQM8sKndGxkL/Pu4tmB+K/mcm8aST97BX2Lc9i:enUlbzbuxW4uKmEK/mc+m97BWcw
Score

9^/10

evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaretrojan

behavioral2