b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543 | Triage

Sharing

General

Target

b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543
Size

552KB
Sample

221125-3ht9mseg38
MD5

67a532c43f067779df6eac4ae0acc07c
SHA1

cbf2efd61bebfa08613cf66a66b87e0a8a259af8
SHA256

b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543
SHA512

f5e80473ad2747f596ee48d56f167ab58964249fffadb2dec1119ff4f4b200a6115845f3d8702dfff3a0ef57a33428bd41afd57d8cecd6e509b8cebc22cc749a
SSDEEP

6144:vUZjWquq3bBE4oKTKFvhAp080KqKoePisPa2hHoFXl5iwtWTFM2qWqWMBugSl3NP:8ZjLucE4/KR7KqKoe6sPJhIFW9TZP9h

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543
- Size
  
  552KB
- MD5
  
  67a532c43f067779df6eac4ae0acc07c
- SHA1
  
  cbf2efd61bebfa08613cf66a66b87e0a8a259af8
- SHA256
  
  b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543
- SHA512
  
  f5e80473ad2747f596ee48d56f167ab58964249fffadb2dec1119ff4f4b200a6115845f3d8702dfff3a0ef57a33428bd41afd57d8cecd6e509b8cebc22cc749a
- SSDEEP
  
  6144:vUZjWquq3bBE4oKTKFvhAp080KqKoePisPa2hHoFXl5iwtWTFM2qWqWMBugSl3NP:8ZjLucE4/KR7KqKoe6sPJhIFW9TZP9h
Score

9^/10

evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaretrojan

behavioral2