4932d6fa5bf268a2712d451e2f88bb33e4cef5b2a77a0b556bca334cc415b6c8 | Triage

Sharing

General

Target

3KHY7-WNT83-DGQKR-F7HPR-844BM.key
Size

7.1MB
Sample

230629-f5y5sacb28
MD5

4ef838c6831d52f4ce761ed79cdb218b
SHA1

9b189df23199b62764a044e0a11ce1219ec89b58
SHA256

4932d6fa5bf268a2712d451e2f88bb33e4cef5b2a77a0b556bca334cc415b6c8
SHA512

a09e8c57f6153a9115f0dbc43f97f7dc5d22abd4ddebc9d6a7b6d39f3d79e1ea6f1e34919645a2be2bcfa10911d6642c5f01702b7adfe59b3bae99b96756d18e
SSDEEP

196608:hdYeaJDfyGlW21X5Sp6GemDMPwuWg1Lm0p4YPtVZvtq:/YeaJDfDllpfaMP7JOClq

Score

9^/10

evasion pyinstaller ransomware

Malware Config

Targets

- Target
  
  3KHY7-WNT83-DGQKR-F7HPR-844BM.key
- Size
  
  7.1MB
- MD5
  
  4ef838c6831d52f4ce761ed79cdb218b
- SHA1
  
  9b189df23199b62764a044e0a11ce1219ec89b58
- SHA256
  
  4932d6fa5bf268a2712d451e2f88bb33e4cef5b2a77a0b556bca334cc415b6c8
- SHA512
  
  a09e8c57f6153a9115f0dbc43f97f7dc5d22abd4ddebc9d6a7b6d39f3d79e1ea6f1e34919645a2be2bcfa10911d6642c5f01702b7adfe59b3bae99b96756d18e
- SSDEEP
  
  196608:hdYeaJDfyGlW21X5Sp6GemDMPwuWg1Lm0p4YPtVZvtq:/YeaJDfDllpfaMP7JOClq
Score

9^/10

evasion ransomware
- Clears Windows event logs
  evasion ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal on Host

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

behavioral2

evasionransomware