1a99acb43ad9cc114b7858ff1b08c228696279b3fc719e42981b233c5dab0874 | Triage

Sharing

General

Target

1a99acb43ad9cc114b7858ff1b08c228696279b3fc719e42981b233c5dab0874
Size

547KB
Sample

221126-antk3scd5z
MD5

9aa95b27ff879d63f093759239086a50
SHA1

889325176e8c14cf31f0d940abcb0c027af5072b
SHA256

1a99acb43ad9cc114b7858ff1b08c228696279b3fc719e42981b233c5dab0874
SHA512

4349e92b874316c8479d006452652e7e755f55116364bcc86f29719a4123f518736d7bb1df9c8a5f09ca9a5ec858974d0b4182710fc442209fc0cfa094e7db74
SSDEEP

12288:uQ3gf7q14BqI/jHzh1GRLYT1ZneaqiTALuNGSRWGN62PedWTEOr:5gTq1KqI/zz/GqZnE/uNGyltPeggOr

Score

9^/10

persistence ransomware

Malware Config

Targets

- Target
  
  1a99acb43ad9cc114b7858ff1b08c228696279b3fc719e42981b233c5dab0874
- Size
  
  547KB
- MD5
  
  9aa95b27ff879d63f093759239086a50
- SHA1
  
  889325176e8c14cf31f0d940abcb0c027af5072b
- SHA256
  
  1a99acb43ad9cc114b7858ff1b08c228696279b3fc719e42981b233c5dab0874
- SHA512
  
  4349e92b874316c8479d006452652e7e755f55116364bcc86f29719a4123f518736d7bb1df9c8a5f09ca9a5ec858974d0b4182710fc442209fc0cfa094e7db74
- SSDEEP
  
  12288:uQ3gf7q14BqI/jHzh1GRLYT1ZneaqiTALuNGSRWGN62PedWTEOr:5gTq1KqI/zz/GqZnE/uNGyltPeggOr
Score

9^/10

persistence ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

persistenceransomware

behavioral2