b7d0437898713b3efc028a47ffe5315380eb42198bc6212aa50112b9d86526f6 | Triage

Sharing

General

Target

b7d0437898713b3efc028a47ffe5315380eb42198bc6212aa50112b9d86526f6
Size

275KB
Sample

221128-cpnsbscc7w
MD5

bb7e3681903e5017e21cef404cec1ef5
SHA1

82e1498916575128946e1696462b4d1b3981cf5a
SHA256

b7d0437898713b3efc028a47ffe5315380eb42198bc6212aa50112b9d86526f6
SHA512

8516a7fe87cc7fc30951e1beda1a8eddd5f02c90d67877ab35165653b207ea3e1741d35af08bdcfaf861b7591c3ee894eafd0ecff1ed98d0db6706897972fac7
SSDEEP

6144:i1B5YpVQSxfjeSmI+W9ZJpQCsE9Isl86nen+G/5FjOpmhX:05YfQUwW9ZblL9lPjGT5

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  pacchetto_3829838293001.exe
- Size
  
  454KB
- MD5
  
  e5de0f12eda81d5dfc77cb8789aa8add
- SHA1
  
  7daeacaebb669c079518b5c954affed506e6d27c
- SHA256
  
  001dd7be6ede435578ae4668310bf8a7f937ec23790c00e49fc6c6ce7f01e290
- SHA512
  
  54d9b51e6811997c1c78b4b1a10529f71730056ba22a2aa1774967ebf4fe3157d35f64254bac01ac04de4a20fafc4e58e08b22ddcc6536372a4447a18335bbfd
- SSDEEP
  
  6144:Pp4ORAN6/9ehv5cZK2v1r/q/x82pFpAOarlr98u3Z9ZhCJdyXmGiP9G7ZaJQeYgU:PbRL/MhvCC4Odgmuj/fDJM3PhU
Score

9^/10

evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaretrojan

behavioral2

evasionpersistenceransomwaretrojan