b6de429a7d506a032902b964a5ea0867da48e1bc6118cf03edbfe8289bcd2264 | Triage

Sharing

General

Target

loader.exe
Size

24.9MB
Sample

241122-dmd1sayrgj
MD5

12d091ac76b2145e152b2ed739a4bc86
SHA1

9ce20bb24a00339053e8de0228d5f3e962cb5646
SHA256

b6de429a7d506a032902b964a5ea0867da48e1bc6118cf03edbfe8289bcd2264
SHA512

97ac6933f8f8c74fa9d69a43f0b240c74ce17e46cef44e00f5f63cf2b3e5f61d3ba5d21785e1d4f96a3fa338bcc1e49232f0ec40b522c0a98a3a0bfaaff85d59
SSDEEP

393216:GSzcSuVdw5fOaRnxHMEHqfvUHQlz8Cui841rQwG0QLvCGHPCcVH2AZTFKnjJ:GbPdDaRnxHMEHqUHR7E1kw5iaCtD+

Score

10^/10

discovery evasion execution ransomware

Malware Config

Targets

- Target
  
  loader.exe
- Size
  
  24.9MB
- MD5
  
  12d091ac76b2145e152b2ed739a4bc86
- SHA1
  
  9ce20bb24a00339053e8de0228d5f3e962cb5646
- SHA256
  
  b6de429a7d506a032902b964a5ea0867da48e1bc6118cf03edbfe8289bcd2264
- SHA512
  
  97ac6933f8f8c74fa9d69a43f0b240c74ce17e46cef44e00f5f63cf2b3e5f61d3ba5d21785e1d4f96a3fa338bcc1e49232f0ec40b522c0a98a3a0bfaaff85d59
- SSDEEP
  
  393216:GSzcSuVdw5fOaRnxHMEHqfvUHQlz8Cui841rQwG0QLvCGHPCcVH2AZTFKnjJ:GbPdDaRnxHMEHqUHR7E1kw5iaCtD+
Score

10^/10

discovery evasion execution ransomware
- Deletes NTFS Change Journal
  The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
  ransomware
- Stops running service(s)
  evasion execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Credential Access

Discovery

Remote System Discovery

System Network Configuration Discovery

Internet Connection Discovery

System Time Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Destruction

Inhibit System Recovery

Service Stop

Tasks

static1

behavioral1

discoveryevasionexecutionransomware