50044945bf596b2da6b734d6c4d28f823d221bbbf5a008f9cb722d6b2058b905 | Triage

Sharing

General

Target

50044945bf596b2da6b734d6c4d28f823d221bbbf5a008f9cb722d6b2058b905
Size

554KB
Sample

221125-l5x6dahf43
MD5

4e74a52e417186ba718af37a6f53067f
SHA1

c4866fc4fde0de7ad8f49e63a590a363f432fdab
SHA256

50044945bf596b2da6b734d6c4d28f823d221bbbf5a008f9cb722d6b2058b905
SHA512

7c6c7f0d4e5efa7dc2f70a29328349403b749dc62a67a9c2ab8959b2f729dec3fec73116ba393e81072c7aaf332ccf5bb89fc84d80e83ac974ec25a588477102
SSDEEP

12288:YQjLuRE4xKR72qKoe/ZWsYUxUKQzZZQZsqtOqW:nLueaKR72qKoe/EhdKYavW

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  50044945bf596b2da6b734d6c4d28f823d221bbbf5a008f9cb722d6b2058b905
- Size
  
  554KB
- MD5
  
  4e74a52e417186ba718af37a6f53067f
- SHA1
  
  c4866fc4fde0de7ad8f49e63a590a363f432fdab
- SHA256
  
  50044945bf596b2da6b734d6c4d28f823d221bbbf5a008f9cb722d6b2058b905
- SHA512
  
  7c6c7f0d4e5efa7dc2f70a29328349403b749dc62a67a9c2ab8959b2f729dec3fec73116ba393e81072c7aaf332ccf5bb89fc84d80e83ac974ec25a588477102
- SSDEEP
  
  12288:YQjLuRE4xKR72qKoe/ZWsYUxUKQzZZQZsqtOqW:nLueaKR72qKoe/EhdKYavW
Score

9^/10

evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaretrojan

behavioral2