30ec2730321cf17778320c6edd2e71f0263a9a45b9a18ad606037c15e4cea019 | Triage

Sharing

General

Target

30ec2730321cf17778320c6edd2e71f0263a9a45b9a18ad606037c15e4cea019
Size

149KB
Sample

221128-cm348sga53
MD5

f341280c47f7f73bc89f5539d1a97eb8
SHA1

44d19dd4bec1e0177870a7395eece02590046588
SHA256

30ec2730321cf17778320c6edd2e71f0263a9a45b9a18ad606037c15e4cea019
SHA512

ec753c16f5f9abe3a4b44fc40ac09b4befda9dd43e9a749708e3678a685f7a2204db081c2e0ef1e23bf8416995c7d0aaf00aaca58be59718490a4919dbed72ef
SSDEEP

3072:kJ3vARo5C7grM3hP3UL9QPbOSZ6KgT2vGhxEuYRoioBsHszSv/:klD5CZx3UL9+bOXKyf/iQsH4Sv/

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  Details.Pdf_____________________________________________________________.exe
- Size
  
  193KB
- MD5
  
  30e0b36b2d521349158517b34d4acd78
- SHA1
  
  cd42b3395aa69071e9b60bd6760c356ec91478ee
- SHA256
  
  5578d702c7fd246e11f71c4edb27b316ca267c6161effab324c9f6e6260bc9e5
- SHA512
  
  ead402fd51d9438d94019d5311e6a82b550e436a30df107a5d78b3a83ef89730a9250c8f5b1f5ba1e77373d94cc8d432ffa3f5d9e3ebb2c813dcb8e1be552722
- SSDEEP
  
  3072:9DsjAbUHwEHnhP3UL9QPbOSp6KgT2vGagCJK51YinXp:9DmAAHtx3UL9+bOVKqCJK5mi5
Score

9^/10

evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaretrojan

behavioral2

evasionpersistenceransomwaretrojan