fe714e0c9393bc3bba151c62ef0050b857e70653da44ba5895a4e72165461808 | Triage

Sharing

General

Target

fe714e0c9393bc3bba151c62ef0050b857e70653da44ba5895a4e72165461808
Size

655KB
Sample

221128-gbzpwsea6x
MD5

59ef3417d45e5f5c01e9618aa5e98d8c
SHA1

b130a6752cd9ca2ba059b90be2f058006467006b
SHA256

fe714e0c9393bc3bba151c62ef0050b857e70653da44ba5895a4e72165461808
SHA512

e8450bb56da2845e07e8f8ec92052ee59b8acb3f75a9619e27d60ada685b5fb2655323183d9bc496d6f6964b95efe37f5031833ed5e18cd3c2a08907c87c4194
SSDEEP

12288:ZvmTr+Uyv4s90RZldjktXi1HKoL96xqIcOHCbpByeUH8Ku:YTPsj0vdvHKoLgqIcOHc4tu

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  fe714e0c9393bc3bba151c62ef0050b857e70653da44ba5895a4e72165461808
- Size
  
  655KB
- MD5
  
  59ef3417d45e5f5c01e9618aa5e98d8c
- SHA1
  
  b130a6752cd9ca2ba059b90be2f058006467006b
- SHA256
  
  fe714e0c9393bc3bba151c62ef0050b857e70653da44ba5895a4e72165461808
- SHA512
  
  e8450bb56da2845e07e8f8ec92052ee59b8acb3f75a9619e27d60ada685b5fb2655323183d9bc496d6f6964b95efe37f5031833ed5e18cd3c2a08907c87c4194
- SSDEEP
  
  12288:ZvmTr+Uyv4s90RZldjktXi1HKoL96xqIcOHCbpByeUH8Ku:YTPsj0vdvHKoLgqIcOHc4tu
Score

9^/10

evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaretrojan

behavioral2