1f2c2adcd213a7c8921ea09eeea38c7acf9ac0126d227dddabf76d9f39b82754 | Triage

Sharing

General

Target

1f2c2adcd213a7c8921ea09eeea38c7acf9ac0126d227dddabf76d9f39b82754
Size

281KB
Sample

221126-fddd1aga2t
MD5

8987f2adf0229cd9c3766947dc350834
SHA1

5ab596b16ef2b6cb67aa6dbd6f651df9569fa902
SHA256

1f2c2adcd213a7c8921ea09eeea38c7acf9ac0126d227dddabf76d9f39b82754
SHA512

646d3e850d3b25de0fd6c0a14aa0cfe327cbf348e33b34245d8bfa96a61bca7a0a10bbe5d4870a3ac7209e9749d4a8e594e66f26a6f51a8585afbd519b7edd59
SSDEEP

6144:kDTCdxxJ+71AW1WGfISP8uqNPuaPAPibFD1sFNC106qN+v:kDwxxOOg8RaNFNDOv

Score

9^/10

collection evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  Versamento.Pdf______________________________________________________________.exe
- Size
  
  446KB
- MD5
  
  11ff8a8e9a643deff1dcf58e7e2fdf20
- SHA1
  
  40b1d84b341bae23dc5cfa8dd1c44cf96294cd54
- SHA256
  
  62d0ce15d2dc5825d4bf46690bc296547387f6b74304ba6a6fedbebba440a490
- SHA512
  
  29499106387047744693da395da8aeb695933579f7b1f5dd23613059591215ca60be4021286c04cacf5c02e5726ab28fe2ed15b0a9b6c12571b88532eec156f1
- SSDEEP
  
  12288:/uPIb4kzPgkrw1k2Fr8+o/tH18wtuomhUqlDykX:SItUkrQ5Fr6/n82yblmg
Score

9^/10

collection evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Email Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

collectionevasionpersistenceransomwaretrojan

behavioral2

evasionpersistenceransomwaretrojan