bc0fe6e41d875ee7b506d513b912bc091e818c5e6ed3177e10fc95639c6488f1 | Triage

Sharing

General

Target

bc0fe6e41d875ee7b506d513b912bc091e818c5e6ed3177e10fc95639c6488f1
Size

316KB
Sample

221124-ysrt2sfd48
MD5

4a54ada98072c3d14bef401b895a85b7
SHA1

cf13a9010f9b2ff7b4d15f6e90d73795d10b109f
SHA256

bc0fe6e41d875ee7b506d513b912bc091e818c5e6ed3177e10fc95639c6488f1
SHA512

9ba65a1a84c86398722dfba6bff1608a2198e292a815a5fa9d3bc52c4acb77bb188af84911965c9b2eb25edb647cfa35df008a0a3739d1c4bfe72e49522500cf
SSDEEP

6144:3rDe+vBgqxkUR7qHJnOgw2rAnqhq2p7Og/uErjYAzh6ZI5ZmsQ:3rDpBgak2WHJnxbMnqhPOg/uErEAzh61

Score

9^/10

collection evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  bc0fe6e41d875ee7b506d513b912bc091e818c5e6ed3177e10fc95639c6488f1
- Size
  
  316KB
- MD5
  
  4a54ada98072c3d14bef401b895a85b7
- SHA1
  
  cf13a9010f9b2ff7b4d15f6e90d73795d10b109f
- SHA256
  
  bc0fe6e41d875ee7b506d513b912bc091e818c5e6ed3177e10fc95639c6488f1
- SHA512
  
  9ba65a1a84c86398722dfba6bff1608a2198e292a815a5fa9d3bc52c4acb77bb188af84911965c9b2eb25edb647cfa35df008a0a3739d1c4bfe72e49522500cf
- SSDEEP
  
  6144:3rDe+vBgqxkUR7qHJnOgw2rAnqhq2p7Og/uErjYAzh6ZI5ZmsQ:3rDpBgak2WHJnxbMnqhPOg/uErEAzh61
Score

9^/10

collection evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

collectionevasionpersistenceransomwaretrojan

behavioral2

evasionpersistenceransomwaretrojan