89e71eb0a6403725d2f95cb9e6506b8b139a6948a61dc1c5cfedf18648241ec4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

93cbe4ed3d46abe732a124a41e7147a2
Size

446KB
Sample

231222-p7n72acebm
MD5

93cbe4ed3d46abe732a124a41e7147a2
SHA1

94a24be60d90479ce27f7787a86678472aabdc6e
SHA256

89e71eb0a6403725d2f95cb9e6506b8b139a6948a61dc1c5cfedf18648241ec4
SHA512

8f46af90d8a2d78da003a8a395fd7f74cc235595238ee3a3e4d87fee2aa4c8abf6ece403bb3726122d3825437f5d079ea1f8d6b275153bb76b3b0d75c243ef09
SSDEEP

6144:XOOxeLzWoeNqagVRUvOWcTwlOcTeP8uENXIEQSdO8c/AVxYflxiW:txeHWoA/Wr0lfQ8BfLkIVxYfrd

Score

9^/10

collection evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  93cbe4ed3d46abe732a124a41e7147a2
- Size
  
  446KB
- MD5
  
  93cbe4ed3d46abe732a124a41e7147a2
- SHA1
  
  94a24be60d90479ce27f7787a86678472aabdc6e
- SHA256
  
  89e71eb0a6403725d2f95cb9e6506b8b139a6948a61dc1c5cfedf18648241ec4
- SHA512
  
  8f46af90d8a2d78da003a8a395fd7f74cc235595238ee3a3e4d87fee2aa4c8abf6ece403bb3726122d3825437f5d079ea1f8d6b275153bb76b3b0d75c243ef09
- SSDEEP
  
  6144:XOOxeLzWoeNqagVRUvOWcTwlOcTeP8uENXIEQSdO8c/AVxYflxiW:txeHWoA/Wr0lfQ8BfLkIVxYfrd
Score

9^/10

collection evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

collectionevasionpersistenceransomwaretrojan

behavioral2