0e2e74e717b7e047a62dad53cafe31eb26f481086507c7ce2e95ad1bb66db7bb | Triage

Sharing

General

Target

0e2e74e717b7e047a62dad53cafe31eb26f481086507c7ce2e95ad1bb66db7bb
Size

287KB
Sample

221124-jaf79sbf8x
MD5

dcd6e52f2caeafa113f1c60001869b77
SHA1

a79961c2b141b7b428a77f920c3840d7414e76ce
SHA256

0e2e74e717b7e047a62dad53cafe31eb26f481086507c7ce2e95ad1bb66db7bb
SHA512

788482df2dd4b350daea201e1edd0454f7fa7edffad7b7bc0d6345c26b17b004ae679b857b60d26ea1251dca43c982a08b994c090cff709f841fcccf4e251fea
SSDEEP

6144:RdsTCKMJBKYHLpBPttGSpqHS60d7BD20C5SaQR82NSXUByX:RdsMJ7VttpsS60dBDFSURNNSXu0

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  Info.Pdf____________________________________________________________.exe
- Size
  
  470KB
- MD5
  
  1325ea7384a4653a3a337381cfe180fa
- SHA1
  
  eb2eae4cc2a5c7356b4e00c0f3d44788c4ae27e0
- SHA256
  
  2c6e410c276a53ad9c2f0560604a42bcd487e0d853b6f524b6db278ca112b81d
- SHA512
  
  dcaae00a97123d7d97773bdb52f99ea79c20f8a39a5366195c8fa916c7111f69117a91f259fef0ec7d6f67b7e69f734cfe7058c14696aef94ef4fcd1a0378b3d
- SSDEEP
  
  6144:eicL4qwxpzEuqcQM8sKndGxkL/Pu4tmB+K/mcm8aST97BX2Lc9i:enUlbzbuxW4uKmEK/mc+m97BWcw
Score

9^/10

evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaretrojan

behavioral2