a42884d84750d8c487b35fd729edaa3dffdd51bdffa0e5527047700f4498ae3c | Triage

Sharing

General

Target

a42884d84750d8c487b35fd729edaa3dffdd51bdffa0e5527047700f4498ae3c
Size

287KB
Sample

221124-nz6xfaeh8w
MD5

92607a24b1ea44049021043b6e510712
SHA1

d77dfad38261f266b0325e1a6c4bead8eb076fc5
SHA256

a42884d84750d8c487b35fd729edaa3dffdd51bdffa0e5527047700f4498ae3c
SHA512

0a3a09ce3060f0adcc2d0ece25a10ca2056180e53580394d510826783fe6168fbb72f28483af50df4c8b7addbd7fc481f5114091ddeae9d99a21431223358766
SSDEEP

6144:SO23nLeWTIvX4fjzVqGZ9HewfnLeJupxrfl5cEOBAAdyVl4:0bWvX4vVqkV1fLKExrPcEsdu4

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  Info.Pdf____________________________________________________________.exe
- Size
  
  478KB
- MD5
  
  3346650620e7a2161f761bb9d1958220
- SHA1
  
  1c7e265e0a9c7cacc4f073f506279907d02ed6fb
- SHA256
  
  7a0dc2d9d5c14e0869ef9caa240bc24d170130b5c5689ef1f83454e97a14feee
- SHA512
  
  a7f1ad5b86b89428518d6452d63e27fc2a26f30cb869e65ce1e5acb7b484f4ea0fb9bc4108655d80d9d13bcdc56527cfffd86b2f60a1bfd573dfa5694bde9d6a
- SSDEEP
  
  6144:bicL4qwxpzEaqcQMfx/o9JAKcQrdSTfXE1Sp2XyWOfevI0Fzm12qlw:bnUlbz3H/o99cOSTf0S2Xyk1f8w
Score

9^/10

evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaretrojan

behavioral2