32969f4676fc16aed3dff471d9eba8306e4c49cfd7510848ddbde2d6e075ab01 | Triage

Sharing

General

Target

32969f4676fc16aed3dff471d9eba8306e4c49cfd7510848ddbde2d6e075ab01
Size

311KB
Sample

221128-ck32fsca2y
MD5

d68818fc1d7d5789d412a085844d602a
SHA1

dca676d8ccbaeefc8bd01f65a43252ab144359ea
SHA256

32969f4676fc16aed3dff471d9eba8306e4c49cfd7510848ddbde2d6e075ab01
SHA512

e51271013b02c1fced7f3f6a6b55026fdc32aeb0e42912947eb7de071392b743775b95dadc0f4f987538417791d01d90e3ba18ddce0b18f2a213a54117041c9b
SSDEEP

6144:1BeryOjPmxonkwbeP/b3ER912H+J/+sHvTjhgoxZqoyxbr+EvK:1BeryOjPmxon5bwz80QXHv3hPxZqoYan

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  32969f4676fc16aed3dff471d9eba8306e4c49cfd7510848ddbde2d6e075ab01
- Size
  
  311KB
- MD5
  
  d68818fc1d7d5789d412a085844d602a
- SHA1
  
  dca676d8ccbaeefc8bd01f65a43252ab144359ea
- SHA256
  
  32969f4676fc16aed3dff471d9eba8306e4c49cfd7510848ddbde2d6e075ab01
- SHA512
  
  e51271013b02c1fced7f3f6a6b55026fdc32aeb0e42912947eb7de071392b743775b95dadc0f4f987538417791d01d90e3ba18ddce0b18f2a213a54117041c9b
- SSDEEP
  
  6144:1BeryOjPmxonkwbeP/b3ER912H+J/+sHvTjhgoxZqoyxbr+EvK:1BeryOjPmxon5bwz80QXHv3hPxZqoYan
Score

9^/10

evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaretrojan

behavioral2

evasionpersistenceransomwaretrojan