58167bd08985f0f621c00eead98d10735511d54150c988adb34dac1e08fd1356 | Triage

Sharing

General

Target

58167bd08985f0f621c00eead98d10735511d54150c988adb34dac1e08fd1356
Size

275KB
Sample

221128-cpmj9scc7v
MD5

87f99ddbe7dfe667af4570f0954a557e
SHA1

cd2281a8d78b1ec6596abebcfc4c893d8e28e6f2
SHA256

58167bd08985f0f621c00eead98d10735511d54150c988adb34dac1e08fd1356
SHA512

83071045397d3c405430123cd6645aebea180b85d4182e0a7fc83ec9082eef1b9ff560aeee7afe51c1624a0847043d52f6842df620ab3f0af73c9ad41c321309
SSDEEP

6144:a2fjoF7oLPq3s46DCSNA6qhFORt8L9N9Vu5vx/Qk:FfjoJoLi3t6WD6qhFORie5vKk

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  Carta certificada_382973927001.exe
- Size
  
  454KB
- MD5
  
  43ce7a42d275d1351de591b3b5d2661d
- SHA1
  
  1ca4ff2afd8407eef291105e53d9136b6178220c
- SHA256
  
  6910aeef12ecba786a855753da0b386ac64874c1086df7ec002ee82a14a93d60
- SHA512
  
  6df6bb7d2ead24e88ab776466fb4dc7fd4cd9043f0f43502089b93819400418efcbc02af92773bca601d5e3d15a24a30f82a8d563d4b11f7ba234df244b86f86
- SSDEEP
  
  6144:PFaURAN6/9ehvQcjKD3aIhc1QJvmao65i0qdFWJera4qN87kRqoEAVwSd+fGgIK8:PvRL/MhvF6NyFfrQJEQR
Score

9^/10

evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaretrojan

behavioral2

evasionpersistenceransomwaretrojan