7d4a438b70e9564aaa7bceea31cd883005b981d5357dc157d16328de080cc8cf | Triage

Sharing

General

Target

7d4a438b70e9564aaa7bceea31cd883005b981d5357dc157d16328de080cc8cf
Size

291KB
Sample

221124-hqfe8sac91
MD5

bedcf9aeacffdf4e975cb6bb253ed2f9
SHA1

b976f8d7b2a0a4d7bef4e3f4b125938f6d2de60c
SHA256

7d4a438b70e9564aaa7bceea31cd883005b981d5357dc157d16328de080cc8cf
SHA512

b4a6f92fa9c9a211ed0009fe8cbf3a0563c705a21e40279452eb634affb1be0ba5ebe4d936534a8214062f98e0df84f33b6ee3833de3b4695936da9c635ff1ad
SSDEEP

6144:he8qRn5DaitOr8GpzIKr5dMfUgMRcNNye9tO2gOt4bQOB7AmLeK:he8qLDU8GpzIKr5dMye9t1tjO9ACeK

Score

9^/10

collection evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  Account.Pdf_____________________________________________________________.exe
- Size
  
  465KB
- MD5
  
  edf51b7c2507590d697e0899c0cadcb5
- SHA1
  
  b59b8c306917ba92c48abba83992e09e9146336c
- SHA256
  
  b3913d567ca228ac32cd35b5d6245393d2b2c1d1c40a60edc55ea7a521f96694
- SHA512
  
  f584b7b81a0d2f154d3c7534c11cbbc8f4743f57eb69721eedd63ac840368fb0cfefffd02f1bc05639932187c1566c5da1f97c34938dbb5132aa97568e6adfac
- SSDEEP
  
  6144:9AKLo20Yi4qqavLoz4cbcJZeCb8Zyf5RmJugB5ejkcWv:9Ls20YivgtQJZeK8ZI5RmsgB5eEv
Score

9^/10

collection evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

collectionevasionpersistenceransomwaretrojan

behavioral2