Overview

overview

7

Static

static

7

AutoHotkey...up.exe

windows10-2004-x64

7

clumsy hotkey.js

windows10-2004-x64

3

clumsy/WinDivert.dll

windows10-2004-x64

1

clumsy/Win...64.sys

windows10-2004-x64

1

clumsy/clumsy.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    clumsy.rar

  • Size

    3.1MB

  • Sample

    240511-mjeycacf4x

  • MD5

    51c3e5fd2d0b8bbcc8649f47072ae6b1

  • SHA1

    74227125fa2049039bd1eb26557aa106823e6c20

  • SHA256

    045cd5de254bccdef47685d5669ac04556669b4eca54a751a9ae853ea15f05fb

  • SHA512

    a51839dfe83e96a26d8b3b85cabb19148c7710a4b74024006a38212e9766bd399bcbd4609025232c44ac903ab501f41235bce410f4b079773ff3924c01306286

  • SSDEEP

    49152:1pr+6rpa5COOXUyayKPYOya4gbdNe7oWMHgS5EIfryTEi84RLH3t++7sd9p:1prlraCt9+euuotHgS5EESRLXt++7sdT

Score
7/10
discoveryexecutionupx

Malware Config

Targets

    • Target

      AutoHotkey_2.0.2_setup.exe

    • Size

      2.8MB

    • MD5

      7ce7d260acfddf2dbc0286c1493560b2

    • SHA1

      882b4d50de925a5411b83b47a1dbbd478490131c

    • SHA256

      9c8b1aecaf1bdded80bec98ec5ab5b9b9754cbce9439dd9eacc7d1774d1438f8

    • SHA512

      66ec91c9ee568342410e2b84b475b60190dcb31a8bb11b9999c81eefc43418b91dfb5822649d43c4376dbd8d804b3693d05decd30fb0035e190953d445035fcf

    • SSDEEP

      49152:F5eZSM1m5dOO/VtzVrwHUR0QpGrfkrQdYhCl/EllK8g3pOkTQ26:YA9V9NHFpIfyQdzVK48AOkTQD

    Score
    7/10
    discoveryupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

    • Target

      clumsy hotkey.ahk

    • Size

      2KB

    • MD5

      76e8a1857cf727ec994b44adf506f916

    • SHA1

      938fd4fe260e54e9ad158b68353b89ea57c09572

    • SHA256

      f185bf19dc42b6306fd9e591cfe69ad5c5fde719144a04291be2756b6cfa8698

    • SHA512

      fd5a985edf5adb51f5235b5a353cb5a3e192e49716a10562abeebab4eee367f76c3e93bae13788129361f1447c26244e0a88aa47a59044c5c549dc6808597144

    Score
    3/10
    execution
    behavioral2

    • Target

      clumsy/WinDivert.dll

    • Size

      15KB

    • MD5

      1b1284100327d972e017f565dbecf80e

    • SHA1

      5b4f0c122a80478973eb6f9cb3bbcaf186295aea

    • SHA256

      9444a6e6b66f13f666f9c60d1935824f61c7256e35a8cf0440e29baa7fbe42c7

    • SHA512

      4ccb9e233a3573f6eded0efa8fa54ed929818394cdf2153623d902c749d37751da6f489354aa50968e53d42d5ce339f6368dedb7858a4ff43a1927b4338954a4

    • SSDEEP

      384:EHGiP0PYf9pHuGvATXlQRNq/EbUKxcneWuDlE:E9MQf90GvQXlQvAEcehD

    Score
    1/10
    behavioral3

    • Target

      clumsy/WinDivert64.sys

    • Size

      37KB

    • MD5

      3bd5ac2e9d96e680f5dbdd183a58c47d

    • SHA1

      83b08cb5e61c7b37bd710ea01196a26fc8f38610

    • SHA256

      208c092fe77f161c5a313b916d73fa7f6d10dd289bab8bb5dfb3d59aacb27f25

    • SHA512

      6cccd7971f423f72f5dbd01a83a2d27bb2bde63c4d1f5e127d77cfa0df85c289a2c3cd95c110ce38b58b9ea9a49aad18ae50f352ac6b21740d0294f771fbcb78

    • SSDEEP

      768:R5VorUqgJs3/KtdrbYiZdNSRUYjbMUYOUaCdHUZ9fdCrYc:vVorUn9cRUuILLd07fdCU

    Score
    1/10
    behavioral4

    • Target

      clumsy/clumsy.exe

    • Size

      1.4MB

    • MD5

      e346dfab16f0be79ce72a21272e3df6d

    • SHA1

      7d7cb01a81278e42742f3462d63e97b78f856aa8

    • SHA256

      886c9c91eb9e6ed7f4987fdab2ba709db4d0a8a08600bb75b766d454e5913ff1

    • SHA512

      68bd3c446477671fbed8fe48aa900c083511ce8594dc8bb714ae379ee08327573368ba1d82085a1c09af062d48b14ac85d54fedcb58c3564222fc542e3508332

    • SSDEEP

      24576:odQOhDsVixFXYnb6mjH0gRqH9RcEhqsUst:oJYViIb6mjnR0cE0sUst

    Score
    1/10
    behavioral5

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

JavaScript

1
T1059.007

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks