71e34afc13185632b41941c46dbd5c965e5570c461370182c7305b5cabdef188 | Triage

Sharing

General

Target

71e34afc13185632b41941c46dbd5c965e5570c461370182c7305b5cabdef188
Size

287KB
Sample

221124-ptfnqsdf66
MD5

6a24d534872a1d607a3536782abc342d
SHA1

57dc7352b6f17d5d6417452427b61805503bde7f
SHA256

71e34afc13185632b41941c46dbd5c965e5570c461370182c7305b5cabdef188
SHA512

d4839c3b6d7d462d306f485a37fdbfa44cd7d193cd564260b6a802be458e5c1cb00e410170b5b30bd81028d5475615c262f22d789cb6a9e1e26f7edb0f5bb9b8
SSDEEP

6144:SGBx0qiBG+RHAT2eUPzo+rJdO89xunCcpxP+GBUdY:RBaG+Rg+zoeJdX9x4PUdY

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  Info.Pdf____________________________________________________________.exe
- Size
  
  474KB
- MD5
  
  7e3556dc9dc56ef11af7276854f404c8
- SHA1
  
  26f676d0a6a0057fe6aa35a0d025c478d8e05741
- SHA256
  
  efd29f1af6c5e828bc4c1c980ab22ddc0a89c0c7813bf8075b8b8943edc19e5c
- SHA512
  
  d2a5b2c2ed9f628d2c85bac66eeb6af7d19d1b5baed8577acf83701d08b377c47ff3f00a5e590b96136cfab887c15d62622f54a56cc3dd23a507b985fd288bb2
- SSDEEP
  
  6144:dipL4qsxpzEOqcQLO8eNpOsYZqQJgOFATNFadd5G/c9FhkZJh4NCf0oxAOQPTRpD:d6UZbzfZmswqfNFQDuJhEJxR8L0
Score

9^/10

evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaretrojan

behavioral2