a79bb0d047313e02d91cfe0a8e1163739da62bdad9fc3a1cc47d3d036bc854bd | Triage

Sharing

General

Target

a79bb0d047313e02d91cfe0a8e1163739da62bdad9fc3a1cc47d3d036bc854bd
Size

339KB
Sample

221124-l25q2sad2z
MD5

4ccb556f2128808b7c220c6b64ba35f8
SHA1

eff180ac308f026a0926f8a177ce52f427d0ece7
SHA256

a79bb0d047313e02d91cfe0a8e1163739da62bdad9fc3a1cc47d3d036bc854bd
SHA512

c26a7fd15d16ef08aaa087d46712f85fd6c5248912199534b85ae7ecacdf77a31a7252e7f17ce4171d351a99fe81cf533886719d4c86906ab3eaac04a74b79e4
SSDEEP

6144:Q3V3E8LXpGl3Tvsz5q78S2G3Upi18azyd2iCc6jG5PN+ga6hqCtHL8we5b1:8pQ3U589maedN40hqGHLE5B

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  fatura_809506887.exe
- Size
  
  522KB
- MD5
  
  2ad4fc835272034a36a96d49f72bc0c4
- SHA1
  
  eef08716315b7fd1fa3b530d1ebcb8bd6fb06fd6
- SHA256
  
  c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a
- SHA512
  
  a38a4c4be25f70055519ca93253d45e4dcd400a59d9799a0e41603feae0569512e52b237f3aa70ab97139190fcf90f7a5c86b23e40ca9daeb46a2d1c0f7c39e7
- SSDEEP
  
  6144:N6LMUWDqIa6V/Ab/f+4tD7nROEuaRh8YHR51yC9fa2te5gCpWiaXRYCUWw0sLl:cofDT/U/f+4dnGYxn8T9I2Nll
Score

9^/10

evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaretrojan

behavioral2

persistenceransomware