6910aeef12ecba786a855753da0b386ac64874c1086df7ec002ee82a14a93d60 | Triage

Sharing

General

Target

6910aeef12ecba786a855753da0b386ac64874c1086df7ec002ee82a14a93d60
Size

454KB
Sample

221128-cpk2fagb67
MD5

43ce7a42d275d1351de591b3b5d2661d
SHA1

1ca4ff2afd8407eef291105e53d9136b6178220c
SHA256

6910aeef12ecba786a855753da0b386ac64874c1086df7ec002ee82a14a93d60
SHA512

6df6bb7d2ead24e88ab776466fb4dc7fd4cd9043f0f43502089b93819400418efcbc02af92773bca601d5e3d15a24a30f82a8d563d4b11f7ba234df244b86f86
SSDEEP

6144:PFaURAN6/9ehvQcjKD3aIhc1QJvmao65i0qdFWJera4qN87kRqoEAVwSd+fGgIK8:PvRL/MhvF6NyFfrQJEQR

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  6910aeef12ecba786a855753da0b386ac64874c1086df7ec002ee82a14a93d60
- Size
  
  454KB
- MD5
  
  43ce7a42d275d1351de591b3b5d2661d
- SHA1
  
  1ca4ff2afd8407eef291105e53d9136b6178220c
- SHA256
  
  6910aeef12ecba786a855753da0b386ac64874c1086df7ec002ee82a14a93d60
- SHA512
  
  6df6bb7d2ead24e88ab776466fb4dc7fd4cd9043f0f43502089b93819400418efcbc02af92773bca601d5e3d15a24a30f82a8d563d4b11f7ba234df244b86f86
- SSDEEP
  
  6144:PFaURAN6/9ehvQcjKD3aIhc1QJvmao65i0qdFWJera4qN87kRqoEAVwSd+fGgIK8:PvRL/MhvF6NyFfrQJEQR
Score

9^/10

evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaretrojan

behavioral2

evasionpersistenceransomwaretrojan