2c6e410c276a53ad9c2f0560604a42bcd487e0d853b6f524b6db278ca112b81d | Triage

Sharing

General

Target

2c6e410c276a53ad9c2f0560604a42bcd487e0d853b6f524b6db278ca112b81d
Size

470KB
Sample

221124-h9ggmsgf86
MD5

1325ea7384a4653a3a337381cfe180fa
SHA1

eb2eae4cc2a5c7356b4e00c0f3d44788c4ae27e0
SHA256

2c6e410c276a53ad9c2f0560604a42bcd487e0d853b6f524b6db278ca112b81d
SHA512

dcaae00a97123d7d97773bdb52f99ea79c20f8a39a5366195c8fa916c7111f69117a91f259fef0ec7d6f67b7e69f734cfe7058c14696aef94ef4fcd1a0378b3d
SSDEEP

6144:eicL4qwxpzEuqcQM8sKndGxkL/Pu4tmB+K/mcm8aST97BX2Lc9i:enUlbzbuxW4uKmEK/mc+m97BWcw

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  2c6e410c276a53ad9c2f0560604a42bcd487e0d853b6f524b6db278ca112b81d
- Size
  
  470KB
- MD5
  
  1325ea7384a4653a3a337381cfe180fa
- SHA1
  
  eb2eae4cc2a5c7356b4e00c0f3d44788c4ae27e0
- SHA256
  
  2c6e410c276a53ad9c2f0560604a42bcd487e0d853b6f524b6db278ca112b81d
- SHA512
  
  dcaae00a97123d7d97773bdb52f99ea79c20f8a39a5366195c8fa916c7111f69117a91f259fef0ec7d6f67b7e69f734cfe7058c14696aef94ef4fcd1a0378b3d
- SSDEEP
  
  6144:eicL4qwxpzEuqcQM8sKndGxkL/Pu4tmB+K/mcm8aST97BX2Lc9i:enUlbzbuxW4uKmEK/mc+m97BWcw
Score

9^/10

evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaretrojan

behavioral2