001dd7be6ede435578ae4668310bf8a7f937ec23790c00e49fc6c6ce7f01e290 | Triage

Sharing

General

Target

001dd7be6ede435578ae4668310bf8a7f937ec23790c00e49fc6c6ce7f01e290
Size

454KB
Sample

221128-cppdvscc7y
MD5

e5de0f12eda81d5dfc77cb8789aa8add
SHA1

7daeacaebb669c079518b5c954affed506e6d27c
SHA256

001dd7be6ede435578ae4668310bf8a7f937ec23790c00e49fc6c6ce7f01e290
SHA512

54d9b51e6811997c1c78b4b1a10529f71730056ba22a2aa1774967ebf4fe3157d35f64254bac01ac04de4a20fafc4e58e08b22ddcc6536372a4447a18335bbfd
SSDEEP

6144:Pp4ORAN6/9ehv5cZK2v1r/q/x82pFpAOarlr98u3Z9ZhCJdyXmGiP9G7ZaJQeYgU:PbRL/MhvCC4Odgmuj/fDJM3PhU

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  001dd7be6ede435578ae4668310bf8a7f937ec23790c00e49fc6c6ce7f01e290
- Size
  
  454KB
- MD5
  
  e5de0f12eda81d5dfc77cb8789aa8add
- SHA1
  
  7daeacaebb669c079518b5c954affed506e6d27c
- SHA256
  
  001dd7be6ede435578ae4668310bf8a7f937ec23790c00e49fc6c6ce7f01e290
- SHA512
  
  54d9b51e6811997c1c78b4b1a10529f71730056ba22a2aa1774967ebf4fe3157d35f64254bac01ac04de4a20fafc4e58e08b22ddcc6536372a4447a18335bbfd
- SSDEEP
  
  6144:Pp4ORAN6/9ehv5cZK2v1r/q/x82pFpAOarlr98u3Z9ZhCJdyXmGiP9G7ZaJQeYgU:PbRL/MhvCC4Odgmuj/fDJM3PhU
Score

9^/10

evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaretrojan

behavioral2

evasionpersistenceransomwaretrojan