83501ac636445618393d331d2a07cec9d0b67cd93c8c05f702cb532ac054ef64 | Triage

Sharing

General

Target

ac0258ee62a0b015c7bf1b56c626ed71
Size

149KB
Sample

231222-q2gfnsbfhj
MD5

ac0258ee62a0b015c7bf1b56c626ed71
SHA1

d79fed4c4f2b12d848f554c261eea2ab99319e88
SHA256

83501ac636445618393d331d2a07cec9d0b67cd93c8c05f702cb532ac054ef64
SHA512

70c53f204ef8269d3eebf09b248316dbd4d7c1f040e325a48e15abac7a2b6e9a5511b13647833752278d9813d1bb81a2abb05097eb10e57a12dd724c967b2a62
SSDEEP

3072:/J3vARo5C7grM3hP3UL9QPbOSZ6KgT2vGhxEuYRoioBsHszSvu:/lD5CZx3UL9+bOXKyf/iQsH4Svu

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  Price.Pdf_____________________________________________________________.exe
- Size
  
  193KB
- MD5
  
  30e0b36b2d521349158517b34d4acd78
- SHA1
  
  cd42b3395aa69071e9b60bd6760c356ec91478ee
- SHA256
  
  5578d702c7fd246e11f71c4edb27b316ca267c6161effab324c9f6e6260bc9e5
- SHA512
  
  ead402fd51d9438d94019d5311e6a82b550e436a30df107a5d78b3a83ef89730a9250c8f5b1f5ba1e77373d94cc8d432ffa3f5d9e3ebb2c813dcb8e1be552722
- SSDEEP
  
  3072:9DsjAbUHwEHnhP3UL9QPbOSp6KgT2vGagCJK51YinXp:9DmAAHtx3UL9+bOVKqCJK5mi5
Score

9^/10

evasion persistence ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaretrojan

behavioral2

evasionpersistenceransomwaretrojan