c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a | Triage

Sharing

General

Target

c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a
Size

522KB
Sample

221124-l2378afd46
MD5

2ad4fc835272034a36a96d49f72bc0c4
SHA1

eef08716315b7fd1fa3b530d1ebcb8bd6fb06fd6
SHA256

c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a
SHA512

a38a4c4be25f70055519ca93253d45e4dcd400a59d9799a0e41603feae0569512e52b237f3aa70ab97139190fcf90f7a5c86b23e40ca9daeb46a2d1c0f7c39e7
SSDEEP

6144:N6LMUWDqIa6V/Ab/f+4tD7nROEuaRh8YHR51yC9fa2te5gCpWiaXRYCUWw0sLl:cofDT/U/f+4dnGYxn8T9I2Nll

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a
- Size
  
  522KB
- MD5
  
  2ad4fc835272034a36a96d49f72bc0c4
- SHA1
  
  eef08716315b7fd1fa3b530d1ebcb8bd6fb06fd6
- SHA256
  
  c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a
- SHA512
  
  a38a4c4be25f70055519ca93253d45e4dcd400a59d9799a0e41603feae0569512e52b237f3aa70ab97139190fcf90f7a5c86b23e40ca9daeb46a2d1c0f7c39e7
- SSDEEP
  
  6144:N6LMUWDqIa6V/Ab/f+4tD7nROEuaRh8YHR51yC9fa2te5gCpWiaXRYCUWw0sLl:cofDT/U/f+4dnGYxn8T9I2Nll
Score

9^/10

evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaretrojan

behavioral2

persistenceransomware