239f1c7708f8d05c6860008b982bb446c5d54dc917c9dea2b6ae78589e072afc | Triage

Sharing

General

Target

239f1c7708f8d05c6860008b982bb446c5d54dc917c9dea2b6ae78589e072afc
Size

740KB
Sample

221128-dr4r1afa2s
MD5

af0581cc9f5d885911af35789f7d7fae
SHA1

f02bb8043c3a5fce7a15798af18b5fa8a2192ecd
SHA256

239f1c7708f8d05c6860008b982bb446c5d54dc917c9dea2b6ae78589e072afc
SHA512

e058664567dc37379c3bcc165cc0c43303e139462ede0d54858ae24476ad0fda8454b635ba4053dcdabdf4f7c0f5fac416add6b8f10755e4834650236380698f
SSDEEP

12288:Vsp8fcP7cG9CZmSqKd89MP70IKV07HSo+qyQAO9IJLY3CZ/f:i8qbfwd8WP4bVgHSo+qLd92LFn

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  239f1c7708f8d05c6860008b982bb446c5d54dc917c9dea2b6ae78589e072afc
- Size
  
  740KB
- MD5
  
  af0581cc9f5d885911af35789f7d7fae
- SHA1
  
  f02bb8043c3a5fce7a15798af18b5fa8a2192ecd
- SHA256
  
  239f1c7708f8d05c6860008b982bb446c5d54dc917c9dea2b6ae78589e072afc
- SHA512
  
  e058664567dc37379c3bcc165cc0c43303e139462ede0d54858ae24476ad0fda8454b635ba4053dcdabdf4f7c0f5fac416add6b8f10755e4834650236380698f
- SSDEEP
  
  12288:Vsp8fcP7cG9CZmSqKd89MP70IKV07HSo+qyQAO9IJLY3CZ/f:i8qbfwd8WP4bVgHSo+qLd92LFn
Score

9^/10

evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaretrojan

behavioral2

evasionpersistenceransomwaretrojan