cf0eed4a772ddce4823d434ecad5b4296a0af94d057535d0a18e762ce79f81e1 | Triage

Sharing

General

Target

cf0eed4a772ddce4823d434ecad5b4296a0af94d057535d0a18e762ce79f81e1
Size

503KB
Sample

221124-m3djmacg6z
MD5

aaf1572112e467c4667ab84bcdee33b2
SHA1

a1b4610140a1901995bedacb82ac1392d0890067
SHA256

cf0eed4a772ddce4823d434ecad5b4296a0af94d057535d0a18e762ce79f81e1
SHA512

3f86ed1eb5a123a93c789c6165784f92ddd389ff680e3b0d96a0d334e31650c7bf21bd2dd973c697446d83d02427aea729574a61e80ac787e574eef4d958b0c9
SSDEEP

12288:mN7OjRhWIqHcFED5g3GrkppAkpmRhW3J8lBhZLTt2:eOllqHcCF2IHWZ8ltLTt2

Score

9^/10

evasion persistence ransomware

Malware Config

Targets

- Target
  
  cf0eed4a772ddce4823d434ecad5b4296a0af94d057535d0a18e762ce79f81e1
- Size
  
  503KB
- MD5
  
  aaf1572112e467c4667ab84bcdee33b2
- SHA1
  
  a1b4610140a1901995bedacb82ac1392d0890067
- SHA256
  
  cf0eed4a772ddce4823d434ecad5b4296a0af94d057535d0a18e762ce79f81e1
- SHA512
  
  3f86ed1eb5a123a93c789c6165784f92ddd389ff680e3b0d96a0d334e31650c7bf21bd2dd973c697446d83d02427aea729574a61e80ac787e574eef4d958b0c9
- SSDEEP
  
  12288:mN7OjRhWIqHcFED5g3GrkppAkpmRhW3J8lBhZLTt2:eOllqHcCF2IHWZ8ltLTt2
Score

9^/10

evasion ransomware persistence
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Drops file in Drivers directory
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionransomware

behavioral2

evasionpersistenceransomware