7f794e4899f8bdefa145f39f2431de86f066055f9aeb66444adbd24838c780e3 | Triage

Sharing

General

Target

7f794e4899f8bdefa145f39f2431de86f066055f9aeb66444adbd24838c780e3
Size

291KB
Sample

221124-p2jelahd51
MD5

522fc085868e6810bbe2e38aa489a7fb
SHA1

4821d407111868ed5803e64bba4ec5afa349a2ea
SHA256

7f794e4899f8bdefa145f39f2431de86f066055f9aeb66444adbd24838c780e3
SHA512

080e3206fef061d9fd0510752b2baf0807b2bc2ac2ecaca8adce800674e164beaa1b9567b924549ff1783ba73214a9d54af85508f960aba378d42793aa03630c
SSDEEP

6144:6L8Li3w59nhQT+pMhMZoM4mo/edDpah1lGVaKef1B+Ft+Qux7Xd:6L8Lig9nhQT/O+M4pyArQFtzuxp

Score

9^/10

collection evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  Info.Pdf_____________________________________________________________.exe
- Size
  
  465KB
- MD5
  
  79ad66c118590b6e114104dea40b1f4c
- SHA1
  
  e984c551b479b25401269712cc33379e5ca4592a
- SHA256
  
  83b99d932fc1fcfb0dc382d405c4a646832c33885208fcbe69e9b5436a74502b
- SHA512
  
  77817354d178d9fe629772b8e412c310b5989678910c350d450da6b0a2df43fcd6974bb70e478dcefc3a48ae4e9adc1c8ba9394b47e7a5291d3d10218865e7a5
- SSDEEP
  
  6144:9AKLo20Yi4qqavLTmK9uG6SL2LQoYKynkH8ninottN37F7PYrP+y9h:9Ls20YivTmQuKyQoYLnkH8nH9PYrPF
Score

9^/10

collection evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Email Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

collectionevasionpersistenceransomwaretrojan

behavioral2