2108fd5ea8c612fe47bf24a7c557e841d290f77daeabe68747bf7775e9146bb5 | Triage

Sharing

General

Target

2108fd5ea8c612fe47bf24a7c557e841d290f77daeabe68747bf7775e9146bb5
Size

281KB
Sample

221126-fdcsgacf56
MD5

09cca1e41da3f7fc57e90706d8212e29
SHA1

1000bbb6d7a2330ee345e1126d5a5e1e2192a75e
SHA256

2108fd5ea8c612fe47bf24a7c557e841d290f77daeabe68747bf7775e9146bb5
SHA512

534cdee92bfa105703f47f27f30429fb9e14a3920c3ad8e42ca8f65d0a97ba50b665f04144458072769078c8313ad2cb659b2db2d8f9acaed2f527feb02a672d
SSDEEP

6144:IDTCdxxJ+71AW1WGfISP8uqNPuaPAPibFD1sFNC106qN+j:IDwxxOOg8RaNFNDOj

Score

9^/10

collection evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  Saldo.Pdf______________________________________________________________.exe
- Size
  
  446KB
- MD5
  
  11ff8a8e9a643deff1dcf58e7e2fdf20
- SHA1
  
  40b1d84b341bae23dc5cfa8dd1c44cf96294cd54
- SHA256
  
  62d0ce15d2dc5825d4bf46690bc296547387f6b74304ba6a6fedbebba440a490
- SHA512
  
  29499106387047744693da395da8aeb695933579f7b1f5dd23613059591215ca60be4021286c04cacf5c02e5726ab28fe2ed15b0a9b6c12571b88532eec156f1
- SSDEEP
  
  12288:/uPIb4kzPgkrw1k2Fr8+o/tH18wtuomhUqlDykX:SItUkrQ5Fr6/n82yblmg
Score

9^/10

collection evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Email Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

collectionevasionpersistenceransomwaretrojan

behavioral2

evasionpersistenceransomwaretrojan