156c734b2817afebbac8f489b206154cccae619079e95af90b83bd8aca4fb59a | Triage

Sharing

General

Target

156c734b2817afebbac8f489b206154cccae619079e95af90b83bd8aca4fb59a
Size

777KB
Sample

221128-cl6hzaca9w
MD5

f498b490551fb872aded182a378be645
SHA1

4a946d7700af23de8d376061fd8c3a504e08dd14
SHA256

156c734b2817afebbac8f489b206154cccae619079e95af90b83bd8aca4fb59a
SHA512

2aa9f069bd9e7ace1d689031ec6d7e08b2afe71f7b0fe5e0f0b916ca1ff74799590a2feef4e9de5155c48bf83691d307a87bbbed11b4619b25127a588842fb95
SSDEEP

12288:6ztHM/d+Ba5WQUhat0w64lyMvYL8ZxFJC0uMONbwWQsV3v7X4D7vA0lvtwC6/6U7:Nwc53xt0wjJvYLUx1uMOJvj4f9

Score

9^/10

evasion persistence ransomware

Malware Config

Targets

- Target
  
  156c734b2817afebbac8f489b206154cccae619079e95af90b83bd8aca4fb59a
- Size
  
  777KB
- MD5
  
  f498b490551fb872aded182a378be645
- SHA1
  
  4a946d7700af23de8d376061fd8c3a504e08dd14
- SHA256
  
  156c734b2817afebbac8f489b206154cccae619079e95af90b83bd8aca4fb59a
- SHA512
  
  2aa9f069bd9e7ace1d689031ec6d7e08b2afe71f7b0fe5e0f0b916ca1ff74799590a2feef4e9de5155c48bf83691d307a87bbbed11b4619b25127a588842fb95
- SSDEEP
  
  12288:6ztHM/d+Ba5WQUhat0w64lyMvYL8ZxFJC0uMONbwWQsV3v7X4D7vA0lvtwC6/6U7:Nwc53xt0wjJvYLUx1uMOJvj4f9
Score

9^/10

evasion persistence ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Drops file in Drivers directory
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomware

behavioral2