219ebb5bc124f2f6d0ca432c866939fce8db694cc724cf230162f74b8639b09f | Triage

Sharing

General

Target

219ebb5bc124f2f6d0ca432c866939fce8db694cc724cf230162f74b8639b09f
Size

254KB
Sample

221128-cn6xhscc4z
MD5

768ea56e1d92cbd4a02e1f79e39bd991
SHA1

2089a744bb37a93e4389b72222d22870c56fbb81
SHA256

219ebb5bc124f2f6d0ca432c866939fce8db694cc724cf230162f74b8639b09f
SHA512

d7ab5d3ce3f05b6c9dbec94b4f3620e263dade0d33881890b346532974acfbcf959692fef3fc3cc567b751599e7dbda9f7b29ee4a1c6932bcbc2f609bd0c2d56
SSDEEP

6144:y2gFzYOVUgVw+5wtAmsSpkZoKPNw8ZOz/7brjdjOc8oZUYur:y5+OVUgJa30+n/jdjCRFr

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  PrivateMessage.wav______________________________________________________________.exe
- Size
  
  311KB
- MD5
  
  d68818fc1d7d5789d412a085844d602a
- SHA1
  
  dca676d8ccbaeefc8bd01f65a43252ab144359ea
- SHA256
  
  32969f4676fc16aed3dff471d9eba8306e4c49cfd7510848ddbde2d6e075ab01
- SHA512
  
  e51271013b02c1fced7f3f6a6b55026fdc32aeb0e42912947eb7de071392b743775b95dadc0f4f987538417791d01d90e3ba18ddce0b18f2a213a54117041c9b
- SSDEEP
  
  6144:1BeryOjPmxonkwbeP/b3ER912H+J/+sHvTjhgoxZqoyxbr+EvK:1BeryOjPmxon5bwz80QXHv3hPxZqoYan
Score

9^/10

evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaretrojan

behavioral2

evasionpersistenceransomwaretrojan