89449048c26e55260368ad62591d10b3a39025976809f52e139c6f09ed51f6c3 | Triage

Sharing

General

Target

89449048c26e55260368ad62591d10b3a39025976809f52e139c6f09ed51f6c3
Size

254KB
Sample

221128-cn5dpagb38
MD5

3d0bf6404492f810c28ab00883017fa6
SHA1

22c73f60822883553e6e566246e62ab9931b44a7
SHA256

89449048c26e55260368ad62591d10b3a39025976809f52e139c6f09ed51f6c3
SHA512

a7de5b5c09748754380cac3a76dda3f2661e7c01f3e31e5eb0c098b4d4e5f1ffe422be60a6eaa3b38dff73c074534ad1d7742937f1574c4dcef5f3dae903d37f
SSDEEP

6144:R2gFzYOVUgVw+5wtAmsSpkZoKPNw8ZOz/7brjdjOc8oZUYu+:R5+OVUgJa30+n/jdjCRF+

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  Details.Pdf_____________________________________________________________.exe
- Size
  
  311KB
- MD5
  
  d68818fc1d7d5789d412a085844d602a
- SHA1
  
  dca676d8ccbaeefc8bd01f65a43252ab144359ea
- SHA256
  
  32969f4676fc16aed3dff471d9eba8306e4c49cfd7510848ddbde2d6e075ab01
- SHA512
  
  e51271013b02c1fced7f3f6a6b55026fdc32aeb0e42912947eb7de071392b743775b95dadc0f4f987538417791d01d90e3ba18ddce0b18f2a213a54117041c9b
- SSDEEP
  
  6144:1BeryOjPmxonkwbeP/b3ER912H+J/+sHvTjhgoxZqoyxbr+EvK:1BeryOjPmxon5bwz80QXHv3hPxZqoYan
Score

9^/10

evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaretrojan

behavioral2

evasionpersistenceransomwaretrojan