7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee | Triage

Sharing

General

Target

7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee
Size

478KB
Sample

221124-nz43vabg93
MD5

3346650620e7a2161f761bb9d1958220
SHA1

1c7e265e0a9c7cacc4f073f506279907d02ed6fb
SHA256

7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee
SHA512

a7f1ad5b86b89428518d6452d63e27fc2a26f30cb869e65ce1e5acb7b484f4ea0fb9bc4108655d80d9d13bcdc56527cfffd86b2f60a1bfd573dfa5694bde9d6a
SSDEEP

6144:bicL4qwxpzEaqcQMfx/o9JAKcQrdSTfXE1Sp2XyWOfevI0Fzm12qlw:bnUlbz3H/o99cOSTf0S2Xyk1f8w

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee
- Size
  
  478KB
- MD5
  
  3346650620e7a2161f761bb9d1958220
- SHA1
  
  1c7e265e0a9c7cacc4f073f506279907d02ed6fb
- SHA256
  
  7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee
- SHA512
  
  a7f1ad5b86b89428518d6452d63e27fc2a26f30cb869e65ce1e5acb7b484f4ea0fb9bc4108655d80d9d13bcdc56527cfffd86b2f60a1bfd573dfa5694bde9d6a
- SSDEEP
  
  6144:bicL4qwxpzEaqcQMfx/o9JAKcQrdSTfXE1Sp2XyWOfevI0Fzm12qlw:bnUlbz3H/o99cOSTf0S2Xyk1f8w
Score

9^/10

evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaretrojan

behavioral2