d50a33604103f5235f27594a2c0c47b826ab174a3e2f135b7e96ac8c3445ceb4 | Triage

Sharing

General

Target

d50a33604103f5235f27594a2c0c47b826ab174a3e2f135b7e96ac8c3445ceb4
Size

291KB
Sample

221124-p8nb5aef36
MD5

a657e6cc1536a52ce55643b61653a17a
SHA1

01ec050e0e13b2ef4ea1e8308f6d238bb80d3229
SHA256

d50a33604103f5235f27594a2c0c47b826ab174a3e2f135b7e96ac8c3445ceb4
SHA512

d9408b81690ec68406bd44d9adb4fd45b3b73e427c1a860ad4b544208ec540f6bcbc4ed9930b962387e50f012c54031d3b5cc7ae9f9934c6aec58c1ea1014e1d
SSDEEP

6144:GL8Li3w59nhQT+pMhMZoM4mo/edDpah1lGVaKef1B+Ft+Qux7XZ:GL8Lig9nhQT/O+M4pyArQFtzuxN

Score

9^/10

collection evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  Invoice.Pdf_____________________________________________________________.exe
- Size
  
  465KB
- MD5
  
  79ad66c118590b6e114104dea40b1f4c
- SHA1
  
  e984c551b479b25401269712cc33379e5ca4592a
- SHA256
  
  83b99d932fc1fcfb0dc382d405c4a646832c33885208fcbe69e9b5436a74502b
- SHA512
  
  77817354d178d9fe629772b8e412c310b5989678910c350d450da6b0a2df43fcd6974bb70e478dcefc3a48ae4e9adc1c8ba9394b47e7a5291d3d10218865e7a5
- SSDEEP
  
  6144:9AKLo20Yi4qqavLTmK9uG6SL2LQoYKynkH8ninottN37F7PYrP+y9h:9Ls20YivTmQuKyQoYLnkH8nH9PYrPF
Score

9^/10

collection evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Email Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

collectionevasionpersistenceransomwaretrojan

behavioral2