6bf4433fbea4827e61ee5239a7c0a17b1ea592c77dc75e5e156f41aa7a2eca83 | Triage

Sharing

General

Target

6bf4433fbea4827e61ee5239a7c0a17b1ea592c77dc75e5e156f41aa7a2eca83
Size

557KB
Sample

221125-3ywseagb26
MD5

65c094df3fd52240b1068d843ba91a1f
SHA1

bf071072b54701aacd3f303e94350ecce7642a50
SHA256

6bf4433fbea4827e61ee5239a7c0a17b1ea592c77dc75e5e156f41aa7a2eca83
SHA512

ffe93848e1594a747226cd12bd58cc848ef1fb0d73e09aaa4b68b1e6901a02a35bd94ee1b324225817e0eb7bb44f7ebc4c78b5de526dc9f68b87829102816964
SSDEEP

12288:zzjLu+E49KR7KqKoeW64scN73mvT44t0K7MW/t03FroN/Ai:jLuleKR7KqKoeW641Nrq8mf7MW/t0Jox

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  6bf4433fbea4827e61ee5239a7c0a17b1ea592c77dc75e5e156f41aa7a2eca83
- Size
  
  557KB
- MD5
  
  65c094df3fd52240b1068d843ba91a1f
- SHA1
  
  bf071072b54701aacd3f303e94350ecce7642a50
- SHA256
  
  6bf4433fbea4827e61ee5239a7c0a17b1ea592c77dc75e5e156f41aa7a2eca83
- SHA512
  
  ffe93848e1594a747226cd12bd58cc848ef1fb0d73e09aaa4b68b1e6901a02a35bd94ee1b324225817e0eb7bb44f7ebc4c78b5de526dc9f68b87829102816964
- SSDEEP
  
  12288:zzjLu+E49KR7KqKoeW64scN73mvT44t0K7MW/t03FroN/Ai:jLuleKR7KqKoeW641Nrq8mf7MW/t0Jox
Score

9^/10

evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaretrojan

behavioral2