6cce73ec191a3fa382ea3fce157b2cc21d5decd71db0193e07d184a5adf9b462 | Triage

Sharing

General

Target

6cce73ec191a3fa382ea3fce157b2cc21d5decd71db0193e07d184a5adf9b462
Size

147KB
Sample

221128-gxgffabd88
MD5

2653b0e170899c2b5eab42d5c2f618c3
SHA1

1f6a06110ddbba0a6f752c2ffd37d20670ae59a5
SHA256

6cce73ec191a3fa382ea3fce157b2cc21d5decd71db0193e07d184a5adf9b462
SHA512

f0901eee7c60572b9da1e21a97c627f61a7a19b38db12b4bcd1b016d79c26e64c400ec776a048e9060e075c9be0aab4c56e9c21e94a42248d7fc10d5d9d70fb1
SSDEEP

3072:/9PmZGDb1lnTikqY1jnyAsHjwwT+DqCM+mduhWc+9kHNVYDYuG:vf15uBYy2eaMv8v+9sY

Score

9^/10

persistence ransomware

Malware Config

Targets

- Target
  
  6cce73ec191a3fa382ea3fce157b2cc21d5decd71db0193e07d184a5adf9b462
- Size
  
  147KB
- MD5
  
  2653b0e170899c2b5eab42d5c2f618c3
- SHA1
  
  1f6a06110ddbba0a6f752c2ffd37d20670ae59a5
- SHA256
  
  6cce73ec191a3fa382ea3fce157b2cc21d5decd71db0193e07d184a5adf9b462
- SHA512
  
  f0901eee7c60572b9da1e21a97c627f61a7a19b38db12b4bcd1b016d79c26e64c400ec776a048e9060e075c9be0aab4c56e9c21e94a42248d7fc10d5d9d70fb1
- SSDEEP
  
  3072:/9PmZGDb1lnTikqY1jnyAsHjwwT+DqCM+mduhWc+9kHNVYDYuG:vf15uBYy2eaMv8v+9sY
Score

9^/10

persistence ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Drops startup file
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

persistenceransomware

behavioral2