486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b | Triage

Sharing

General

Target

486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b
Size

244KB
Sample

221126-ljlv8abd3x
MD5

796fdae3b1476ed20cdac74ca9d40973
SHA1

1067f53a9e67a61f41d649874e7c40a1e0a2cb2e
SHA256

486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b
SHA512

1948b409fa2d680708ca8b839576597d24bd7a90537c7dd07f22c08ce9edd775153d00ace206565bd6012803347c9be253db04206fbb36e85e9b0997a2c39157
SSDEEP

6144:AhBgQhoowwzLDmJYIdzNjlIccwO33XdGaSb:Ah2QhpNKJYIdzNjcndGaA

Score

9^/10

persistence ransomware

Malware Config

Targets

- Target
  
  486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b
- Size
  
  244KB
- MD5
  
  796fdae3b1476ed20cdac74ca9d40973
- SHA1
  
  1067f53a9e67a61f41d649874e7c40a1e0a2cb2e
- SHA256
  
  486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b
- SHA512
  
  1948b409fa2d680708ca8b839576597d24bd7a90537c7dd07f22c08ce9edd775153d00ace206565bd6012803347c9be253db04206fbb36e85e9b0997a2c39157
- SSDEEP
  
  6144:AhBgQhoowwzLDmJYIdzNjlIccwO33XdGaSb:Ah2QhpNKJYIdzNjcndGaA
Score

9^/10

ransomware persistence
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Drops startup file
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

behavioral2