52a6d5e35047fa5c952bad7469706ef0f0dff4658abe73eb5563eb704ce8568e | Triage

Sharing

General

Target

52a6d5e35047fa5c952bad7469706ef0f0dff4658abe73eb5563eb704ce8568e
Size

740KB
Sample

221128-d253taff7z
MD5

0df48f8ca20443a9f260def3c32b9770
SHA1

81193d5873c7b291b7c0e24c459c40fd648ed68a
SHA256

52a6d5e35047fa5c952bad7469706ef0f0dff4658abe73eb5563eb704ce8568e
SHA512

b7e898ccd5cf3a8549a3e5aabbc53117174ea50f3c1d878bacb610f101b76fdca39b51e370600ee8e14379aef98415719d5af4164ef9b18afff7a1684adb85a4
SSDEEP

12288:iep8fcP7cG9CZmSqKd89MP70IKViOvYeHSo+6XWnEzUYjD9a:H8qbfwd8WP4bVLvHHSo+IWk1a

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  52a6d5e35047fa5c952bad7469706ef0f0dff4658abe73eb5563eb704ce8568e
- Size
  
  740KB
- MD5
  
  0df48f8ca20443a9f260def3c32b9770
- SHA1
  
  81193d5873c7b291b7c0e24c459c40fd648ed68a
- SHA256
  
  52a6d5e35047fa5c952bad7469706ef0f0dff4658abe73eb5563eb704ce8568e
- SHA512
  
  b7e898ccd5cf3a8549a3e5aabbc53117174ea50f3c1d878bacb610f101b76fdca39b51e370600ee8e14379aef98415719d5af4164ef9b18afff7a1684adb85a4
- SSDEEP
  
  12288:iep8fcP7cG9CZmSqKd89MP70IKViOvYeHSo+6XWnEzUYjD9a:H8qbfwd8WP4bVLvHHSo+IWk1a
Score

9^/10

evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaretrojan

behavioral2

evasionpersistenceransomwaretrojan