6bd1d9ad83ba7d05dac38b7a546437de571805f5c0b99e96c2e5e63d368e7e0f | Triage

Sharing

General

Target

6bd1d9ad83ba7d05dac38b7a546437de571805f5c0b99e96c2e5e63d368e7e0f
Size

784KB
Sample

221128-e2wptaaf4v
MD5

bd2a8d5a3e22913c773187edb9dac24d
SHA1

e0f750d27cc0fb78890212a996ccb717312facd1
SHA256

6bd1d9ad83ba7d05dac38b7a546437de571805f5c0b99e96c2e5e63d368e7e0f
SHA512

bb1040f0abb0798cdef5e6a1ae7c351f459571053a22b7f09c8502c49c0f0b5be1436818ed46fa1dd143291de5316258bc9bbb1223d801cc23a8d398e0ff99b8
SSDEEP

24576:SB0sDNiUfiPgI91kgveYzHSoGQfWRXFOcDaz6sm9:SZ5iUU5nBeYzHSoGV8cJsC

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  6bd1d9ad83ba7d05dac38b7a546437de571805f5c0b99e96c2e5e63d368e7e0f
- Size
  
  784KB
- MD5
  
  bd2a8d5a3e22913c773187edb9dac24d
- SHA1
  
  e0f750d27cc0fb78890212a996ccb717312facd1
- SHA256
  
  6bd1d9ad83ba7d05dac38b7a546437de571805f5c0b99e96c2e5e63d368e7e0f
- SHA512
  
  bb1040f0abb0798cdef5e6a1ae7c351f459571053a22b7f09c8502c49c0f0b5be1436818ed46fa1dd143291de5316258bc9bbb1223d801cc23a8d398e0ff99b8
- SSDEEP
  
  24576:SB0sDNiUfiPgI91kgveYzHSoGQfWRXFOcDaz6sm9:SZ5iUU5nBeYzHSoGV8cJsC
Score

9^/10

evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaretrojan

behavioral2

evasionpersistenceransomwaretrojan