c0731dbf1275bd33c4a6f61c8ea74555529189f2728d91485f427be28665f0ab | Triage

Sharing

General

Target

c0731dbf1275bd33c4a6f61c8ea74555529189f2728d91485f427be28665f0ab
Size

291KB
Sample

221124-mvwegacc8t
MD5

3f5d4d5f7d34b4285bac9a47170eccf0
SHA1

3e5784cb3f8e2e946947b2c4a8da066f92390643
SHA256

c0731dbf1275bd33c4a6f61c8ea74555529189f2728d91485f427be28665f0ab
SHA512

584e45b5a6d866a3b57f86f87c5d0f7fcdbfa4bb79462276347c44990974f935bc230b2057c0558886c58af9434d44dae45e0c12f95b5d26b391a617ae81cbf2
SSDEEP

6144:Le8qRn5DaitOr8GpzIKr5dMfUgMRcNNye9tO2gOt4bQOB7AmLeQ:Le8qLDU8GpzIKr5dMye9t1tjO9ACeQ

Score

9^/10

collection evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  Info.Pdf_____________________________________________________________.exe
- Size
  
  465KB
- MD5
  
  edf51b7c2507590d697e0899c0cadcb5
- SHA1
  
  b59b8c306917ba92c48abba83992e09e9146336c
- SHA256
  
  b3913d567ca228ac32cd35b5d6245393d2b2c1d1c40a60edc55ea7a521f96694
- SHA512
  
  f584b7b81a0d2f154d3c7534c11cbbc8f4743f57eb69721eedd63ac840368fb0cfefffd02f1bc05639932187c1566c5da1f97c34938dbb5132aa97568e6adfac
- SSDEEP
  
  6144:9AKLo20Yi4qqavLoz4cbcJZeCb8Zyf5RmJugB5ejkcWv:9Ls20YivgtQJZeK8ZI5RmsgB5eEv
Score

9^/10

collection evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Email Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

collectionevasionpersistenceransomwaretrojan

behavioral2