d798fdc5f093af2d4ad2d3a663e3b4f3f8c9d23c58c4493238bd598375308162 | Triage

Sharing

General

Target

d798fdc5f093af2d4ad2d3a663e3b4f3f8c9d23c58c4493238bd598375308162
Size

287KB
Sample

221124-jm6npace9x
MD5

b0710804b8d1057855fdefcfa0112e66
SHA1

78db1b4541e821fb43d147e7809607733180b3ce
SHA256

d798fdc5f093af2d4ad2d3a663e3b4f3f8c9d23c58c4493238bd598375308162
SHA512

c0ea42cc24cc9a8e2b3f64538681d5bbc7b61863437898db5ff8eb2214dfed6adb9ebd82a227c9fd303b2d8b0a2d97a31972abedc6d536019ad9a120acfa3475
SSDEEP

6144:AriQX1MtON1KK/qEsvuOmCIY7OZ7S1p6TOMhmvnEiVpXiW+pJ1R7:f1AKoqECpegOZ7S7SO5oW+bv

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  Processing.Pdf____________________________________________________________.exe
- Size
  
  478KB
- MD5
  
  e46421290522060e95dc6c6ac9bab9c8
- SHA1
  
  08aaa1203dca088e366ea31253ec264ca710f015
- SHA256
  
  c7715cabaa44e33a7e60bc3599924d77e0021383d2f6b1b0ecd5e84bcbfb62c2
- SHA512
  
  d590f467b8ebcc8805d910506585033c29c6f3f47b232cf2ebbfea91bf139e135b197ecd8a599521b25cf45fa0e46932e992842651ffe4d0c71b9c2d866369a5
- SSDEEP
  
  6144:/ipL4qsxpzEeqcQL3dOk+yrctZl/nS0JSAS2cu1PfFjHNNj9iL:/6UZbzH2Ok+HbrJSycwl/j90
Score

9^/10

evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaretrojan

behavioral2