f2ff60957f197cf7781d73f0111bf3c7938e324cc8066eabe9f7eb34ee9c0c4f

Sharing

Copy URL Twitter E-mail

General

Target
HWID Bypass.zip
Size 3.0MB
Sample240613-acantswemd
SHA256 f2ff60957f197cf7781d73f0111bf3c7938e324cc8066eabe9f7eb34ee9c0c4f
MD5 998d4ee0271d8f535a4d03e686caa251
SHA1 4f18c1d5119522efd949e58f1891e2f80d9ae77c
SHA512 2b0472d5a096035ae39961e99ac1f84e2ac8d76a51ef2c75900d7073df4687f6e6e367b32750b461743143414f90b586b960850cfcd06393d3461997b819379d
SSDEEP 49152:fa7tWev8ZfRW9/sGxwmGQ49vP8ZgAyelloRNLvsRr6YmmV+qh3AwtzKjXZxN6nj2:fetWev8Zf49UGxwxQuvEZg21rERquXvB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery

Malware Config

Targets

- Target
  HWID Bypass/STEP 1 - Uninstall_Clear Traces/Download Revo Uninstaller.url
- Size 153B
- SHA256 f6db928c42771e18d7795dab63dc991ec8d3dc371e8b4804d467f65ce11c607f
- MD5 b8af8aa3d0d8003e486b3f952bafbaac
- SHA1 d452237651cb4b04ea8ade827cbb3512f69c0f9d
- SHA512 a34972401cca357962507ac28907ad83eac902235f52608b77a1ee005032bbf5f76fbc65a2bead1d5cab85ff867641926a281a0fb3df145282bbd93e8de49b7f
- MD5 SHA1 SHA512
Score

1^/10
behavioral1
- Target
  HWID Bypass/STEP 1 - Uninstall_Clear Traces/Updated Step 1 - Follow instructions on website.url
- Size 148B
- SHA256 c7a9eb7d13feaaccf24d3cc3a591fe47dbcd1b228bd287c75422776aeb71a4e5
- MD5 ef9fa18d6d49e92eaf2324b0d014813a
- SHA1 f68a93434a8829909bb047bffb57b8271121f78d
- SHA512 5c44360313ce713b3fceaf1a16de6ce66fd2f567d225f80b813f88125a0e3bca21bfd0f4b3ad2a083398778a2183ac2df3e629f5cd57f46215db4e8fbc618b22
- MD5 SHA1 SHA512
Score

1^/10
behavioral2
- Target
  HWID Bypass/STEP 2 - Edit HWID Registry keys/1. Registry Editor.lnk
- Size 1KB
- SHA256 64aa810fa77628dc199f75f54dd764c142b0a479cdb62e24f853a707ca3a2db5
- MD5 0e2092f136d0e7f155a6c688e34533dc
- SHA1 33f71faf7585c7a4a450b91f794334f200bf15f7
- SHA512 8057d335d66ca0257d7c53b3fd681efbd9123c7c5cb955c1b49cbca243e8550cc5210de9044b4481c311873c28fd79ad79f1d32905b473005584631fe61c4f92
- MD5 SHA1 SHA512
Score

3^/10
behavioral3
- Target
  HWID Bypass/STEP 2 - Edit HWID Registry keys/3. GUID Generator Website.url
- Size 143B
- SHA256 21c4de7b2083d60d3f0d2f38e70d1b2a1e0049279b1ade9ba900a77d2e3a64e4
- MD5 dc2726585a60180658c2fb0714e436b8
- SHA1 1568187c8c250ca83340f02d8df4695680a5b0ff
- SHA512 5c495093a71613bbee9e83ca59155c43263274dd9bb83fb6d456ee4c23ed8e7bb11ea2ade66f1e18c83d33f03771ede3da80c50fc7c97809322487cd650f6ce9
- MD5 SHA1 SHA512
Score

1^/10
behavioral4
- Target
  HWID Bypass/STEP 3 - Mask _ Setup your IP Address/1. Download NordVPN.url
- Size 128B
- SHA256 89ff7443cc30c87127b75fe899648c8729beffd67cb91940ca97cacf9085f17f
- MD5 92a3e5db54b4166e789b643b53be9004
- SHA1 1806667f266b68f92272cb45dce83811633c3d6a
- SHA512 a529d0691a6307261cc1a94c1c83df0949552105614bb8c472f684cdabd29970cf451e7c383191eedc198b2068f1749bdfb4727827c5573017914930b73206d3
- MD5 SHA1 SHA512
Score

1^/10
behavioral5
- Target
  HWID Bypass/STEP 4 - Change your Disk Serial NumberID/1. Change Disk IDs.cmd
- Size 1KB
- SHA256 282932d8caacf613b7167f674a84d320af5b9e253f21c8134c46ce25ff4bb07b
- MD5 6346b33980b7d8946c1f0dba5cbfd7f9
- SHA1 c42c97f649afa4b408d25e003277f89b4cdbe7d8
- SHA512 bef23ec08e2e9623a1b8769c509726e36e8d91b23593d59f38a3c7848ea6d07b963728a33ba74cde6da27f1944ca06ed4dd58eed4c7456c0e5c942ae227c2320
- MD5 SHA1 SHA512
Score

1^/10
behavioral6
- Target
  HWID Bypass/STEP 4 - Change your Disk Serial NumberID/_/Volumeid.exe
- Size 228KB
- SHA256 22a2484d7fa799e6e71e310141614884f3bc8dad8ac749b6f1c475b5398a72f3
- MD5 4d867033b27c8a603de4885b449c4923
- SHA1 f1ace1a241bab6efb3c7059a68b6e9bbe258da83
- SHA512 b5d6d4a58d8780a43e69964f80525905224fa020c0032e637cd25557097e331f63d156cceaaacfe1a692ca8cea8d8bd1b219468b6b8e4827c90febe1535a5702
- SSDEEP 3072:OgfbRmDIHA98kK2WndTslNac+dA6YdqhsXCNZpp4GIoHZUFozD3zgJwDmr9u76v9:OSCgkKdcg9vCoaoMpcto
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7
- Target
  HWID Bypass/STEP 4 - Change your Disk Serial NumberID/_/Volumeid64.exe
- Size 165KB
- SHA256 fb0d02ea26bb1e5df5a07147931caf1ae3d7d1d9b4d83f168b678e7f3a1c0ecd
- MD5 81a45f1a91448313b76d2e6d5308aa7a
- SHA1 0d615343d5de03da03bce52e11b233093b404083
- SHA512 675662f84dfcbf33311f5830db70bff50b6e8a34a4a926de6369c446ea2b1cf8a63e9c94e5a5c2e1d226248f0361a1698448f82118ac4de5a92b64d8fdf8815d
- SSDEEP 3072:PngbfXWm18pX82lOl7NuT7DLM5Weo5UFs5QM8JwDmtFk1glurXEa:/gbfXWVoRNuT7DkbFsKM1glI
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral8
- Target
  HWID Bypass/STEP 5 - Change the HWIDs of everything/1. Change ALL HWIDs.cmd
- Size 2KB
- SHA256 74bfdf73031582b1e9431d72fb017a349f279f87d6dddcea63b0eee5c90c3545
- MD5 f79a031d21d43d3293a56d6351070c36
- SHA1 b51ec3847bdc77e15bcacdd8b5a0755de9ce0101
- SHA512 fb0bfd1eca976ed91aa45b5cec5f94fbb1fcf9e57634a25c5867ff5287dc14681533cb1467b850d23c9d719c32578d384dd18e3a4049af6aa8863548d724fbd3
- MD5 SHA1 SHA512
Score

1^/10
behavioral9
- Target
  HWID Bypass/STEP 5 - Change the HWIDs of everything/_/AMIDEWINx64.EXE
- Size 455KB
- SHA256 13037eedd91f9313ec0d807947db65c639642e5ae6497e87d12fa6d19951f78e
- MD5 9adfcdac59db3286690c7eede8da2528
- SHA1 0b54d251438a634bd13b49a1f20587cf03d4598d
- SHA512 fde1700cdb4212593ec2733944a169c7d02f436ca6831719a33482fbfd0be289697c9aa6ce7ddfb6c245e87952b35416929bbf69753d21a24197ac6c2d1243cc
- SSDEEP 6144:PRx1SY2XTh/Fq+1VU1/SznTh8NUc9v4/nOmNAFw+lgBwFejOLlC:PR/2N/I+rUqE9inOmNAFwa/TQ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10
- Target
  HWID Bypass/STEP 5 - Change the HWIDs of everything/_/Command Prompt.lnk
- Size 1KB
- SHA256 8bee776a81eedf942937bf03cdec43b1b37f9bc1f4e10a031fb2517fd181d8bc
- MD5 6cba9707b339f1756673d2ed33b5a37a
- SHA1 373e60b3c971605d783a4c6ae44c4ea50322c49a
- SHA512 d670e3be8c72e923c89e3bd18457f8ee1155fca307eb2bcd3970381ff9e761a14eec3d926e5e2091811d4bc3b5bbcb008ee6115c99cf3309444d544966446360
- MD5 SHA1 SHA512
Score

3^/10
behavioral11
- Target
  HWID Bypass/STEP 5 - Change the HWIDs of everything/_/amifldrv64.sys
- Size 29KB
- SHA256 65c26276cadda7a36f8977d1d01120edb5c3418be2317d501761092d5f9916c9
- MD5 f22740ba54a400fd2be7690bb204aa08
- SHA1 5812387783d61c6ab5702213bb968590a18065e3
- SHA512 ac1f89736cf348f634b526569b5783118a1a35324f9ce2f2804001e5a04751f8cc21d09bfa1c4803cd14a64152beba868f5ecf119f10fa3ccbe680d2fb481500
- SSDEEP 384:qvOTI5HIPy54ygZOq0HMMKf69JG8QnuOfZFnJtQSZsHLPK6jjMYiWPFRUI5xl9Wn:qvsUoK54ZCMMb9U82uO7Jt6PKg4YHUc+
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral12
- Target
  HWID Bypass/STEP 6 - Change your MAC address/1. Install TMACv6.0.7_Setup.exe
- Size 5.1MB
- SHA256 a453b3ea8d8133531fad26b18701c694c324cc201e3069d07e99f0e100908c1a
- MD5 a7c8cf1d50ebe630a7d0c47686a0abbf
- SHA1 3229e8080975f4f5512d2382552f68c0389acff5
- SHA512 42340b7435605049e3f817feac1ac238177772b2b1ebf05eb9311bb58ee3dd1cab39913240a4c39e3407374009310770d8221c31914549524ecd92beab93b787
- SSDEEP 98304:ARU3j4wtopcj2dqCYV1coZ4hv3tmF1b6CrjfW/sfH6s7zQcKDsVv/JLSF66b/:ARqt/CdqRc64hv3tmF1b6CffW/sfH6sm
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral13
- Target
  HWID Bypass/STEP 7 - Create or buy a new game account/G2G.url
- Size 122B
- SHA256 5c263f91f5f549cbf021d033beb7e53da0a5f95b4bdaf44720dba91980d6d6cc
- MD5 537624fd98a6aa4709c6e69a2617b676
- SHA1 7761de0b0899822a8890cd96d67a5c1b7497377b
- SHA512 44ad5266d46ba05b1f520098a16612995fdee752d1a1c6daec2d36429531b4ddd3ef3c8f691f0f0cdef42d1a5a91b55e53e3d2ab8890d5f1a63dd791621bce9e
- MD5 SHA1 SHA512
Score

1^/10
behavioral14
- Target
  HWID Bypass/STEP 7 - Create or buy a new game account/MMOGA.url
- Size 109B
- SHA256 c834276c57e91798db5c577e011954b85706937cb203048e34bdafb4e964e2c5
- MD5 3146cd554b223f5425f8eeb73ca1fd22
- SHA1 7f94312a9e0afdc9f7c150eeef8e0a77a362450a
- SHA512 26de7b5323448206a39af1d102b6f9dafdd96414d4caec9ae4df181e94e982ca4c0f6b8347c48da7cf93aca13bfba4eb6b4ee82893ea31fb241966d2803d4323
- MD5 SHA1 SHA512
Score

1^/10
behavioral15
- Target
  HWID Bypass/STEP 7 - Create or buy a new game account/MMOGAH.url
- Size 134B
- SHA256 fb25b287aba473e2fc9fbbce2dbb92cc90d86e94fe54b91c6c5ec290ef00094f
- MD5 f7e17290359b067a5643677da12ca4be
- SHA1 f86b191acab3a05b40b93035124c3883e5776f17
- SHA512 95dddb066872d16723426d6a413cf86027c36c9a7f4b4ee08305cadf9e3af8351849c511aa9569785d536694cd9549a68780c62e7fa5a41e588f6fc0afdd4043
- MD5 SHA1 SHA512
Score

1^/10
behavioral16
- Target
  HWID Bypass/STEP 8 - Change Monitor HWID/CRU.exe
- Size 1.2MB
- SHA256 8e151b2a680913f627052e18349fb9a4151c7b9ed7afa13b45df3923f450c8ab
- MD5 33ddbeafa1ef85263ff2de5f95b271ef
- SHA1 a5736867ac8d2ce41f8600ff32e949c8b1825854
- SHA512 758c5cb44be54693361f7519f1c6d4468fc40b2603a3871c8da85b96b97668aae8850ce4319cac60dde22dd5cbf50121a804233782a4f2db22f6fe30ad41f13e
- SSDEEP 24576:wR63SAdWjAvfArbdNBWQV4sU1FR5HcIT/FVAY+t+QzyTcO:GbdNAbc0o1Ec
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17
- Target
  HWID Bypass/STEP 8 - Change Monitor HWID/reset-all.exe
- Size 51KB
- SHA256 70639c195430afb92799d711ed784406bfdfd04c648d5f3e4d9873da0063660b
- MD5 3d47586c62bf61dac639d8cc1bf43ee7
- SHA1 36f605e1fb7cae972c6723ded6a5f126f36a8d01
- SHA512 638a75c0159de8553e8071a68b5a4355bfc002489d9ed62bfbb1019d287073a555133bd4a55abd68c51b3e2a1616f586a26998ce32ade322cd72ffeab5ffe105
- SSDEEP 768:Jd0XBRNU+hV81e14G8xGvMhBmqVHhc6ZrLy01fA5Egt2rHNZAEDFn27DQNE5B:b0XbeQ8xG0Kqjc6lLFfSortZBMDu8
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral18
- Target
  HWID Bypass/STEP 8 - Change Monitor HWID/restart.exe
- Size 63KB
- SHA256 b68ee265308dc9da7dbb521bb71238d27ac50a5ee816f21c13818393be982d7a
- MD5 8242ce426ad462eff02edae1487a6949
- SHA1 9a4f382d427e0de729053535aaa3310cac5f087b
- SHA512 aff43a78d29ede49eac386d9b0b44d0f37d5a20bdda8553369d68dec90bbc727c6dd8fe239987a9d2e3affaeff8b72b5023ed973d7aecfbb99de46dca8c99ef1
- SSDEEP 768:xa+/MMnf2XivrjhmxEQSQIjDaGva2XaT+CSxKUAch9Itvo7vq2XFelWn2iED5Vx0:xa0wstmSpDaGS2RCSxK28otXFQwUx
- MD5 SHA1 SHA512 SSDEEP
Score

5^/10
- Drops file in System32 directory
behavioral19
- Target
  HWID Bypass/STEP 8 - Change Monitor HWID/restart64.exe
- Size 73KB
- SHA256 5f779bb822aedaf5bd11693cdf73f6c7c3342f37371a78c07c2aca1e15dbfd00
- MD5 297aa19bade534a791d053ca190b74ad
- SHA1 15cb6a33994f75fe9e30a2afbc8a7e4616b63962
- SHA512 df883950c598f31b81f22a68b2a9fed7459dcad5084ec6e39399658b0492bcc458d9fc5bb80fda6bc994bed3241f969fc67a0b8e021fb82b040455d64776c625
- SSDEEP 1536:8vXMJl7uRupZzidl/T+Dnx86Rpy4roKsIrryeq3OTM:8vMJl6RAZu/T+7x8qpRM8rNcOTM
- MD5 SHA1 SHA512 SSDEEP
Score

5^/10
- Drops file in System32 directory
behavioral20
- Target
  HWID Bypass/STEP 9 - Hide Mouse, Keyboard, and Controller serial numbers/USBDeview.chm
- Size 24KB
- SHA256 63606a5617a62060a2894904bf28d53f9f80cbe7b1be885cec114173d054767c
- MD5 411e4fba3110e963a85ceaf46e8cedd2
- SHA1 4272eb5976e951c448fab798f7b1fb0437f8f148
- SHA512 c8cdb839b6a49591a64a949d8602ef14703d47a7c90b300db9a4b64fd59a8e3b3e6ee6f4881732a05ff480fc23241848cc99852733e1049da5342b7b4e176ce4
- SSDEEP 384:9TXSD100stETnEaqFqFWWreTy7H9CluSY1t5A2Xzo:9TCDWtEL8Fy0yH92zY1/A2Do
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21
- Target
  HWID Bypass/STEP 9 - Hide Mouse, Keyboard, and Controller serial numbers/USBDeview.exe
- Size 189KB
- SHA256 95e50f7eea21bfed82a34a24bc5d66029146c7b988e889b11f30b45cb364dcf1
- MD5 5c1729d2611fdcaeeadd238c1f0427c7
- SHA1 ddcfca0994cc92783d6a942075166f026c88ed07
- SHA512 47c608e0590e1f73c32a0c677f9b81738fb188b27243e99d514911158d673f18ae7ef99ea897e87c850c5588eae19e3d6ae8736e0a974dd51f438f5190e362c5
- SSDEEP 3072:3FSG80yvkmcA4bEvLhWoLdpxgZZapW9T8iXcWWbgYrrzwKeugTedajIHNNSP7g8x:fyvkC6EvLhTLdpxgZRbWJdBHNNSd689
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral22

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Checks installed software on the system

Drops file in System32 directory

Drops file in System32 directory

Drops file in System32 directory

Enumerates connected drives

Maps connected drives based on registry

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22