aea9bfeb25e07b462f619700e263cc7dbc3d79a17435f6cee374348186264faf | Triage

Sharing

General

Target

aea9bfeb25e07b462f619700e263cc7dbc3d79a17435f6cee374348186264faf
Size

710KB
Sample

221204-vw9mgsac49
MD5

413cd7a56e1efb382c26f80f72cdb42d
SHA1

d6221156ba019ecf8739775ae09fbad7889e20ee
SHA256

aea9bfeb25e07b462f619700e263cc7dbc3d79a17435f6cee374348186264faf
SHA512

59b43c5ec3461c36f612eba24ab5b9ff0703f98dc090c6915bdc371f6f866a62d39d6b20ae2eae27f1ee06831f173839a1b7d54858354883aea1417c12ae374a
SSDEEP

12288:hp0aUZq6gKoYW9hUVKOwdk6e/GTElxqbbCir2QwofboRILsw7rSsUAo:hCTZ9q9hMqU/OmK12YMRw

Score

9^/10

evasion persistence ransomware

Malware Config

Targets

- Target
  
  aea9bfeb25e07b462f619700e263cc7dbc3d79a17435f6cee374348186264faf
- Size
  
  710KB
- MD5
  
  413cd7a56e1efb382c26f80f72cdb42d
- SHA1
  
  d6221156ba019ecf8739775ae09fbad7889e20ee
- SHA256
  
  aea9bfeb25e07b462f619700e263cc7dbc3d79a17435f6cee374348186264faf
- SHA512
  
  59b43c5ec3461c36f612eba24ab5b9ff0703f98dc090c6915bdc371f6f866a62d39d6b20ae2eae27f1ee06831f173839a1b7d54858354883aea1417c12ae374a
- SSDEEP
  
  12288:hp0aUZq6gKoYW9hUVKOwdk6e/GTElxqbbCir2QwofboRILsw7rSsUAo:hCTZ9q9hMqU/OmK12YMRw
Score

9^/10

evasion persistence ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Drops file in Drivers directory
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomware

behavioral2