fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7
Size

121KB
Sample

240318-q3dq6sah3s
MD5

eac0a08470ee67c63b14ae2ce7f6aa61
SHA1

285c0163376d5d9a5806364411652fe73424d571
SHA256

fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7
SHA512

f3fd7eeae18843d049443f0d5e818302eb3b3f73ad85e26c01e1ddc0a102a0a22b065afe01879aafc95ff3a2d15b5c302394bd03d91e6c4401648cd4222bddc5
SSDEEP

1536:3THoX8wNjiMsyPcjgbKx534oU6Llg/iLBkZhifkdol9LYuVF5yZbn:DjksYKx5o3Slg/itMg8+LYu9ubn

Score

9^/10

evasion persistence ransomware

Malware Config

Targets

- Target
  
  fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7
- Size
  
  121KB
- MD5
  
  eac0a08470ee67c63b14ae2ce7f6aa61
- SHA1
  
  285c0163376d5d9a5806364411652fe73424d571
- SHA256
  
  fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7
- SHA512
  
  f3fd7eeae18843d049443f0d5e818302eb3b3f73ad85e26c01e1ddc0a102a0a22b065afe01879aafc95ff3a2d15b5c302394bd03d91e6c4401648cd4222bddc5
- SSDEEP
  
  1536:3THoX8wNjiMsyPcjgbKx534oU6Llg/iLBkZhifkdol9LYuVF5yZbn:DjksYKx5o3Slg/itMg8+LYu9ubn
Score

9^/10

evasion persistence ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Service Stop

Tasks

static1

behavioral1

evasionpersistenceransomware

behavioral2

evasionpersistence