decc740c40ca8a427750121c0477328e0ad67ec7b18441f65875fffb12c6563f | Triage

Sharing

General

Target

decc740c40ca8a427750121c0477328e0ad67ec7b18441f65875fffb12c6563f
Size

291KB
Sample

221124-jj2kkahd77
MD5

b273ceaf433d040208ffb0d80001dfd9
SHA1

4247e667c9cf949b55040eeff63d678310c9e375
SHA256

decc740c40ca8a427750121c0477328e0ad67ec7b18441f65875fffb12c6563f
SHA512

cabb55fe940963352e41b793051c90bd71db3c32f01e2940aab8dc733f5a1fc1c72dba363fefd36776cd3bb6a7ea713f69d0b657759b8804b3f3c3cdd615344a
SSDEEP

6144:3L8Li3w59nhQT+pMhMZoM4mo/edDpah1lGVaKef1B+Ft+Qux7XA:3L8Lig9nhQT/O+M4pyArQFtzuxk

Score

9^/10

collection evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  Payment.Pdf_____________________________________________________________.exe
- Size
  
  465KB
- MD5
  
  79ad66c118590b6e114104dea40b1f4c
- SHA1
  
  e984c551b479b25401269712cc33379e5ca4592a
- SHA256
  
  83b99d932fc1fcfb0dc382d405c4a646832c33885208fcbe69e9b5436a74502b
- SHA512
  
  77817354d178d9fe629772b8e412c310b5989678910c350d450da6b0a2df43fcd6974bb70e478dcefc3a48ae4e9adc1c8ba9394b47e7a5291d3d10218865e7a5
- SSDEEP
  
  6144:9AKLo20Yi4qqavLTmK9uG6SL2LQoYKynkH8ninottN37F7PYrP+y9h:9Ls20YivTmQuKyQoYLnkH8nH9PYrPF
Score

9^/10

collection evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Email Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

collectionevasionpersistenceransomwaretrojan

behavioral2