c985f6299a7f95022c204ec68758fca302a702b230b229ed2cd61dc53896908c | Triage

Sharing

General

Target

c985f6299a7f95022c204ec68758fca302a702b230b229ed2cd61dc53896908c
Size

290KB
Sample

221128-gfq9baed3w
MD5

9137b1bb5f43a7a81232e08459307f25
SHA1

d6326244b9ad1ce5aefd9c1e8fd8cbc8efd1b585
SHA256

c985f6299a7f95022c204ec68758fca302a702b230b229ed2cd61dc53896908c
SHA512

198ee5305ce139ae54cc09b716abfd2ed68aa0d13c695e60e5f299d416843bd35fbab7f9c2197c0685f0fe5c5714a70418bde280a11e284b0fbb6e28101cd3da
SSDEEP

6144:L3D/GF0tKgDXjq7gzkdTXkESA+7L39NH/hMxNn6:L7GVyjoVdwESB7DJMxN6

Score

9^/10

persistence ransomware

Malware Config

Targets

- Target
  
  c985f6299a7f95022c204ec68758fca302a702b230b229ed2cd61dc53896908c
- Size
  
  290KB
- MD5
  
  9137b1bb5f43a7a81232e08459307f25
- SHA1
  
  d6326244b9ad1ce5aefd9c1e8fd8cbc8efd1b585
- SHA256
  
  c985f6299a7f95022c204ec68758fca302a702b230b229ed2cd61dc53896908c
- SHA512
  
  198ee5305ce139ae54cc09b716abfd2ed68aa0d13c695e60e5f299d416843bd35fbab7f9c2197c0685f0fe5c5714a70418bde280a11e284b0fbb6e28101cd3da
- SSDEEP
  
  6144:L3D/GF0tKgDXjq7gzkdTXkESA+7L39NH/hMxNn6:L7GVyjoVdwESB7DJMxN6
Score

9^/10

persistence ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Drops startup file
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

persistenceransomware

behavioral2