Overview

overview

9

Static

static

1

af987e9949...17.exe

windows7-x64

9

af987e9949...17.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    af987e9949de476f955b540bd09d88fa36ad66a29a531a554761a9256cdebd17

  • Size

    233KB

  • Sample

    221128-d79cescb77

  • MD5

    55841d5818935938e350943471785894

  • SHA1

    d2a97467a0a92ba167cc1c3020d0172a6623a3d2

  • SHA256

    af987e9949de476f955b540bd09d88fa36ad66a29a531a554761a9256cdebd17

  • SHA512

    ec0ce562c56abede5219d0f05cc0ac9428662e93ed555ce5dc262345c81f4045e7a486a89c3daf379aa864794bc4ac2ea40c06aef524d6143c4259e2e349589b

  • SSDEEP

    6144:88dNXSEprMkKP1yhkGX/PXdTFxNCmng5K+nSP6:npAwrX//tfZ6

Score
9/10
evasionpersistenceransomwaretrojan

Malware Config

Targets

    • Target

      af987e9949de476f955b540bd09d88fa36ad66a29a531a554761a9256cdebd17

    • Size

      233KB

    • MD5

      55841d5818935938e350943471785894

    • SHA1

      d2a97467a0a92ba167cc1c3020d0172a6623a3d2

    • SHA256

      af987e9949de476f955b540bd09d88fa36ad66a29a531a554761a9256cdebd17

    • SHA512

      ec0ce562c56abede5219d0f05cc0ac9428662e93ed555ce5dc262345c81f4045e7a486a89c3daf379aa864794bc4ac2ea40c06aef524d6143c4259e2e349589b

    • SSDEEP

      6144:88dNXSEprMkKP1yhkGX/PXdTFxNCmng5K+nSP6:npAwrX//tfZ6

    Score
    9/10
    evasionpersistenceransomwaretrojan

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

File Deletion

2
T1107

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Tasks