17f8366d6fd211cb3e4e43578cedef2e72b61f6103e3f53969ea59b222e323a1 | Triage

Sharing

General

Target

17f8366d6fd211cb3e4e43578cedef2e72b61f6103e3f53969ea59b222e323a1
Size

287KB
Sample

221124-hjqbvshh7v
MD5

e93ea59e4358bddffe1536ffa914ba54
SHA1

f6373f75940a88c005d3bc45676c7d803109dd20
SHA256

17f8366d6fd211cb3e4e43578cedef2e72b61f6103e3f53969ea59b222e323a1
SHA512

edd5fc644667afd2cf314121879f314524a67d3074efe3b1406eb7e27490d8da3cf0400b4b01044f34288fe103349bed8c28c8a7e3e0098c43237e8b346fb0b6
SSDEEP

6144:9GBx0qiBG+RHAT2eUPzo+rJdO89xunCcpxP+GBUd/:IBaG+Rg+zoeJdX9x4PUd/

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  Processing.Pdf____________________________________________________________.exe
- Size
  
  474KB
- MD5
  
  7e3556dc9dc56ef11af7276854f404c8
- SHA1
  
  26f676d0a6a0057fe6aa35a0d025c478d8e05741
- SHA256
  
  efd29f1af6c5e828bc4c1c980ab22ddc0a89c0c7813bf8075b8b8943edc19e5c
- SHA512
  
  d2a5b2c2ed9f628d2c85bac66eeb6af7d19d1b5baed8577acf83701d08b377c47ff3f00a5e590b96136cfab887c15d62622f54a56cc3dd23a507b985fd288bb2
- SSDEEP
  
  6144:dipL4qsxpzEOqcQLO8eNpOsYZqQJgOFATNFadd5G/c9FhkZJh4NCf0oxAOQPTRpD:d6UZbzfZmswqfNFQDuJhEJxR8L0
Score

9^/10

evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaretrojan

behavioral2