ad73049a31aa72d7dacbc1bcab9d6e86cf788021798e3189f7c770d50de5baba | Triage

Sharing

General

Target

ad73049a31aa72d7dacbc1bcab9d6e86cf788021798e3189f7c770d50de5baba
Size

538KB
Sample

221128-cqaxvsgc24
MD5

4152160a268e0ce56cece046b1b3c9c9
SHA1

ee652db1b1670af87357a6fa6fe6bdb44f4276b7
SHA256

ad73049a31aa72d7dacbc1bcab9d6e86cf788021798e3189f7c770d50de5baba
SHA512

6ed6ce8a2a4e15a6cb10254c5dab6994e17cd723e1c469b3dcbeb0f2952914ae489ac40022e8f3c3d13cc286e8f3acc5f5ef90454eb756a49465b95ffbac64b4
SSDEEP

12288:1X/ufFCT56jLfcva45xuvzIWA0QW+YMuOp2jh8rNn:xgFCN+kpP0zlA0HguQ0ut

Score

9^/10

evasion persistence ransomware

Malware Config

Targets

- Target
  
  Ordine.Pdf________________________________________________________________.exe
- Size
  
  777KB
- MD5
  
  f498b490551fb872aded182a378be645
- SHA1
  
  4a946d7700af23de8d376061fd8c3a504e08dd14
- SHA256
  
  156c734b2817afebbac8f489b206154cccae619079e95af90b83bd8aca4fb59a
- SHA512
  
  2aa9f069bd9e7ace1d689031ec6d7e08b2afe71f7b0fe5e0f0b916ca1ff74799590a2feef4e9de5155c48bf83691d307a87bbbed11b4619b25127a588842fb95
- SSDEEP
  
  12288:6ztHM/d+Ba5WQUhat0w64lyMvYL8ZxFJC0uMONbwWQsV3v7X4D7vA0lvtwC6/6U7:Nwc53xt0wjJvYLUx1uMOJvj4f9
Score

9^/10

evasion persistence ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Drops file in Drivers directory
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomware

behavioral2