Overview

overview

7

Static

static

3

Minecraft....io.exe

windows11-21h2-x64

7

Data/Pytho...le.pyc

windows11-21h2-x64

3

Data/Pytho...y3.pyc

windows11-21h2-x64

3

Data/Pytho...ig.pyc

windows11-21h2-x64

3

Data/Pytho...ke.pyc

windows11-21h2-x64

3

Data/Pytho...cs.pyc

windows11-21h2-x64

3

Data/Pytho...rs.pyc

windows11-21h2-x64

3

Data/Pytho...as.pyc

windows11-21h2-x64

3

Data/Pytho...le.pyc

windows11-21h2-x64

3

Data/Pytho...me.pyc

windows11-21h2-x64

3

Data/Pytho...ng.pyc

windows11-21h2-x64

3

Data/Pytho...on.pyc

windows11-21h2-x64

3

Data/Pytho...ort.py

windows11-21h2-x64

3

Data/audio.dll

windows11-21h2-x64

3

Data/file.dll

windows11-21h2-x64

3

Data/gmbinaryfile.dll

windows11-21h2-x64

3

Data/midiinput.dll

windows11-21h2-x64

3

Data/move.bat

windows11-21h2-x64

1

Data/wallpaper.bat

windows11-21h2-x64

1

Data/window.dll

windows11-21h2-x64

3

DialogModule.dll

windows11-21h2-x64

3

ExecuteShell.dll

windows11-21h2-x64

3

FileDropper.dll

windows11-21h2-x64

3

Minecraft ...io.exe

windows11-21h2-x64

3

NBS Player Mode.bat

windows11-21h2-x64

3

NekoPresence.dll

windows11-21h2-x64

3

ffmpeg.exe

windows11-21h2-x64

3

ffprobe.exe

windows11-21h2-x64

3

pygml.dll

windows11-21h2-x64

3

python38.dll

windows11-21h2-x64

3

uninstall.exe

windows11-21h2-x64

7

window_set_icon.dll

windows11-21h2-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Minecraft.Note.Block.Studio.exe

  • Size

    42.9MB

  • Sample

    240801-zpsgvazhmf

  • MD5

    cad7ed3f0e24ed9d0c642a8db5711b6a

  • SHA1

    526f38aeb0aac98e8dc834af594cba5210555407

  • SHA256

    d49877b56eae195a92a251b8a2323f9271c5d1258c8671d26e03ee44425c0478

  • SHA512

    21d07a10d13cc95ddaadbb7ed3045030c33cff6759af0f091e9058ae1c1b40dabf5ed1add13f62471feb19f3e1b52bd93246cd1b01ff9059aa32d1abd1e2597b

  • SSDEEP

    786432:SeCSW3HLvaImZhgT3s6T/STneTZxcmpMmQO9KWNMurqQVbw+Dw3X6cM:eSC/mz8sEsMemWm/EW6u9bwnU

Score
7/10
discoverypersistenceprivilege_escalation

Malware Config

Targets

    • Target

      Minecraft.Note.Block.Studio.exe

    • Size

      42.9MB

    • MD5

      cad7ed3f0e24ed9d0c642a8db5711b6a

    • SHA1

      526f38aeb0aac98e8dc834af594cba5210555407

    • SHA256

      d49877b56eae195a92a251b8a2323f9271c5d1258c8671d26e03ee44425c0478

    • SHA512

      21d07a10d13cc95ddaadbb7ed3045030c33cff6759af0f091e9058ae1c1b40dabf5ed1add13f62471feb19f3e1b52bd93246cd1b01ff9059aa32d1abd1e2597b

    • SSDEEP

      786432:SeCSW3HLvaImZhgT3s6T/STneTZxcmpMmQO9KWNMurqQVbw+Dw3X6cM:eSC/mz8sEsMemWm/EW6u9bwnU

    Score
    7/10
    discoverypersistenceprivilege_escalation

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1

    • Target

      Data/Python/Lib/site-packages/numpy/typing/tests/data/pass/simple.pyc

    • Size

      2KB

    • MD5

      b4c1048e346a436e36145e0871f08608

    • SHA1

      f75a4e3284e98897b85accb1c801f63ba696f2e0

    • SHA256

      6b2af3209b7c54542ea851734d97b3dabdc15cff1ec6684be412056f8b4ed7a3

    • SHA512

      21264490e16c67c6a022b78935580b48d7d37215529697e3cafd06fc970267c33fb183ed8456dec80fb17429c5f2f92ffa13b32ef29ba57864395c88a9b3907c

    Score
    3/10
    discovery
    behavioral2

    • Target

      Data/Python/Lib/site-packages/numpy/typing/tests/data/pass/simple_py3.pyc

    • Size

      221B

    • MD5

      849e9f38dd1bd591069cd97d05c54885

    • SHA1

      7be26924f95da06dd20c85c1d8e692d1226399fe

    • SHA256

      00518484c9f2694d2a643518893c77d1afbb9af9b098743af70e91b9ea36a915

    • SHA512

      f90398f904a3a0a52fb109b6d34e6ca214183d9d75f245a062041397e20c61c783f3616af547512912568b977695cf3f83d9d3d08b3e989c46a4cadd73b0537a

    Score
    3/10
    discovery
    behavioral3

    • Target

      Data/Python/Lib/site-packages/numpy/typing/tests/data/pass/ufunc_config.pyc

    • Size

      1KB

    • MD5

      6cb1ec22edf71e27d2f98b50e01063df

    • SHA1

      a94608e689684b3340fbaa75771bdbe6e2745624

    • SHA256

      babcf20cd13382e9e841666225f3696638f9e26d730d1d1253c6c57bd3aa3091

    • SHA512

      3275f1b53402e5c1d7254ab8ece6d12d512db9977b16f9d945e55a978bf0f4f265194d4849577a578bf8c3ed25749d5ea5cc8e8a656f6639d78884a8d88ca4b2

    Score
    3/10
    discovery
    behavioral4

    • Target

      Data/Python/Lib/site-packages/numpy/typing/tests/data/pass/ufunclike.pyc

    • Size

      1KB

    • MD5

      5b19fa59a4387ac0b484c1df19e16978

    • SHA1

      9913587355f6410153c35a02c2f84f49375ceb80

    • SHA256

      bb727a3ab502337b81ce044d319ab4ac36681625dd5aa6c23557ddd1af454548

    • SHA512

      e4a8c5c113da6e8e6e87d72a004d2b612a61287358732d279ae0ed25285566e2c870da4963b9dde9837e774693faebee5d1f517ad63eee683c3ce917ef876c39

    Score
    3/10
    discovery
    behavioral5

    • Target

      Data/Python/Lib/site-packages/numpy/typing/tests/data/pass/ufuncs.pyc

    • Size

      601B

    • MD5

      cc6154e38906fe06b624e05b85a3a938

    • SHA1

      6320edb1bf7d9f8fe3718418b9dcd1de63984210

    • SHA256

      91b436f509adead0728903969e06df85cefc80bfcc2386c99ee34ff26cb1b713

    • SHA512

      fd7a7f4bb847d10fcc83646a4822a1766ae73f10386cb8326df183f3855f511f0d47375fc785f6bd80f5b05028482fad7e9f3ea1a28a92b66933748c8958b66a

    Score
    3/10
    discovery
    behavioral6

    • Target

      Data/Python/Lib/site-packages/numpy/typing/tests/data/pass/warnings_and_errors.pyc

    • Size

      312B

    • MD5

      69029d74d369b1fe46d24f882e2c1bd1

    • SHA1

      ba619f2d237c39b899271305eecea5503f837956

    • SHA256

      3230ef6a2b1d9bee409d37093356687b201d086d49ac237c2fc38e392cc9c486

    • SHA512

      d85dc9df3f441cb7a0515f3ce36202a82055869e45a13fcbfeaf445b6e6614ac57d7f989eed5089227629c08a08673f50fd973ad09400c53a267a0ffd1395590

    Score
    3/10
    discovery
    behavioral7

    • Target

      Data/Python/Lib/site-packages/numpy/typing/tests/test_generic_alias.pyc

    • Size

      8KB

    • MD5

      a15b3ba062b5da9bc38ab28dd5d4b62b

    • SHA1

      8728cc82ab7af3a7daf6bde4d27c2d8a64f8feef

    • SHA256

      a99b198ffcc3cca6c43ccea82e4a907009906aab17df7cb576f819e66c979c2e

    • SHA512

      d07af860e34ec11a85397b6bf0bbd088b02f82b02eac3570c981b3ee051659f14b4844eb7476b9be1adbb7c2c68650b63acc39239e4f1e72cbb92e46cc412ea1

    • SSDEEP

      96:8pTLGv57IybiO4uDOlseq6KIJf444t4OQDqYQt/DMSppHoUL+fwiZMbrVNxFlx4B:8hm5tyQ4R/w/xu4brbpEmvz+ilxZhuwq

    Score
    3/10
    discovery
    behavioral8

    • Target

      Data/Python/Lib/site-packages/numpy/typing/tests/test_isfile.pyc

    • Size

      995B

    • MD5

      f0ab8b1a758edd775fcf6bb02df44f05

    • SHA1

      01b1b7844e53cb41f7c26a9762ca44061880eb24

    • SHA256

      e2338b064f1628593c1611aedc3b71ba8e70feda4fe7bafe5a188abb006e4140

    • SHA512

      2d2866175e5750eaf8fc3d00775bc9c386911265d012a19e2d3d34f7246e92b078cbda99632e9400b5a9ccdae563a0b2d80bbd2f23a30f1e6cd59b5320576baf

    Score
    3/10
    discovery
    behavioral9

    • Target

      Data/Python/Lib/site-packages/numpy/typing/tests/test_runtime.pyc

    • Size

      2KB

    • MD5

      198bbb60c0b8cf3a44ae1c4a3f3e297b

    • SHA1

      dd91146bb1031c9300c91402d725982c43a7e6e2

    • SHA256

      f9a48540df3728d029aa7cb62106df937e1e5988eb5c4d3b7ef3739c72b2d48e

    • SHA512

      b38b279b3fd7a59648fdd6c738d8430c902b76ae7bbf1ce8480235acbef20c801ead7c6a9baa62b78324d88bb8dec7f23f9eb5fb92cc9378fa172494ab541ed5

    Score
    3/10
    discovery
    behavioral10

    • Target

      Data/Python/Lib/site-packages/numpy/typing/tests/test_typing.pyc

    • Size

      12KB

    • MD5

      95d0cd56f432bdc91111dac19363a5b1

    • SHA1

      93533f25147f262caf011a9dfac14e6aed391065

    • SHA256

      3afe370dba03dd3523df1d52833cec4cb60ae75444f3e1081d0b45b22d0527c7

    • SHA512

      f1140cd052cbed545fb69206429bfb587dbfcaef4284b9595f30b37e06a08859705a6f92e5313fe3d0aa3eb25643ae82028ab174631fc13c4600483f84c78aa3

    • SSDEEP

      384:UuGs8A5tJxEeVRbZXT4jK9Mug7iVkI5qD3GPtauE1sSW08P:UueqRbUGlxEKP

    Score
    3/10
    discovery
    behavioral11

    • Target

      Data/Python/Lib/site-packages/numpy/version.pyc

    • Size

      559B

    • MD5

      2f8eb06ad1328710475cf756e474a665

    • SHA1

      4b7a710f46cdfdfc23b7ccda8166a5de5d532e90

    • SHA256

      38f5b5f79d9e5ad5e52c31219191e796b1fc6f916ee2a05b6aca2c7fb00c4976

    • SHA512

      62138023267be354aadbd97be31b03c06abf363dc1f10e45540698befb21a11066213de793f63a8bbf243d43c68e74ce98500064556a7d2ec4bb81ddc3ec0d39

    Score
    3/10
    behavioral12

    • Target

      Data/Python/audio_export.py

    • Size

      881B

    • MD5

      48e89e967bd60db7b99d57c1fa75a942

    • SHA1

      6f641287c18593c347ef15a862f9216c52e2814b

    • SHA256

      476d1e3015bc9daea4c9542edd774dc7ce6e404855f582a7a63bcc2c7a456556

    • SHA512

      bd53fac2184803f2c8a1dc0f8c795f91a3b469217374c5d4775e92e9c70cd810159f148dfafb5535a1114bf232acc24d0d046da5aa3e2e6c059083de7d5f059a

    Score
    3/10
    behavioral13

    • Target

      Data/audio.dll

    • Size

      9.9MB

    • MD5

      48281fa7cef5e979bdad2033ca01597e

    • SHA1

      dbe549038db219f5c5b075f69c747d5d561b694c

    • SHA256

      6c57a4dcbe8fcefbbf811df428c5b7ee5be2c40df0e242351f7c627f772725d4

    • SHA512

      3c9285071db125ef6ef093e8ed96effac74ce9edc4c7d069bb013b554731af4728b9e67383eb62009727bf9ed35b1462cd892aea3a72a28395c2e7da7164891b

    • SSDEEP

      196608:DDncxWiAxJ2m30iXVGkjZTClgozl7i8gYTT6zMWGtbuZNS97kUAwkpPWoYK3:fLiAxJ2m30iXVGkdTC5xgYTT6zBGtbu5

    Score
    3/10
    discovery
    behavioral14

    • Target

      Data/file.dll

    • Size

      370KB

    • MD5

      71823ef94ce64e72783720f689d7658a

    • SHA1

      510a78755e555b099514c31975069443729f2fab

    • SHA256

      c4ea167d8ad20110a12870b6c232fc38a84cc2911de2688f72a961e22264ff1c

    • SHA512

      11a1bcbffb83ae05a82133034a11a8285ab15ddc62dba2f49e01dc53844394d6e97b6fa143d2064eecefbc847cf669d9a39d5f5985922667f8ade2ca3326b08e

    • SSDEEP

      6144:zBDO2+HofgRqxCPssBzT9TYDoTBGlQoEiZw8:zBDh+I48xCPssBzODoT0lQxA

    Score
    3/10
    discovery
    behavioral15

    • Target

      Data/gmbinaryfile.dll

    • Size

      348KB

    • MD5

      54e7510adc2d717a897ae843c592eb42

    • SHA1

      35f02ce57ed1e7a10c836838ba7018f8903ae008

    • SHA256

      83941ff51a07b6479fea636b7814417b9bd0e9657dcafb75d6009f2e77f09738

    • SHA512

      603bb307ff918fe8178f06269c3ad1d41d231b613398b08e512fa698b0f0976156301827935094bf44ba67b83200196ad523114b04894bcb7a79b65020c3fc43

    • SSDEEP

      6144:qyNP6EPHEKpVOgI906iUS027EdP+b86PI1FfYusV13MPXxYi7tvsp6Pr1fvIKEdU:1jtr7EdP+b86PSwusv3MPXxYirx

    Score
    3/10
    discovery
    behavioral16

    • Target

      Data/midiinput.dll

    • Size

      102KB

    • MD5

      88345bad6f4bbbf87146663d193e1fb0

    • SHA1

      eeabd096a5fb90b741161791de125446071b20ef

    • SHA256

      b595335a3cf6493f093e9c183a0ac735d2c3e3125fbfbfd04e4984f36496de1c

    • SHA512

      2b963bce749202a829b8595cbb164623b47f0ebaaedf1788fe2d35937d75517309b40d4f17ecb893b81752a2212c6584aa8db51113ec68cc2c223e6875ba17c4

    • SSDEEP

      1536:JvkJ7cWIygUF/5MrqWl2TR9A1qiXg0sI9rYAv+Ich43sWjcdoo14FVTcXceZW:JsJ7cW3NVWATR4JF+poo1aVTcXceZ

    Score
    3/10
    discovery
    behavioral17

    • Target

      Data/move.bat

    • Size

      37B

    • MD5

      1dc4e793875d58a31b6436c3f532fff6

    • SHA1

      5b5514842c6020cba9a9f4f7468ffd9d03d7b281

    • SHA256

      202070e706ad43ba8b66332c72b3829ac6c885ee08be74bf089f3af270b83efb

    • SHA512

      21e145b911519bf26cd32353fb04c448695efa51a6ff213d511f34ca4b25afd3bcdd06a1d580e5f0cc8c2c692019175975aea25675079757e3eb2849989b2956

    Score
    1/10
    behavioral18

    • Target

      Data/wallpaper.bat

    • Size

      86B

    • MD5

      27f6211b9fae475eb4e7701f6ba9533d

    • SHA1

      042e1a7494c9570967933870d5568a7be270fe02

    • SHA256

      8cf013aa324653b78dd95ea55c5306c6f3b48cf403e0256c2b910fa6161358fd

    • SHA512

      4d48d0c5f16582ab4a9b04a9a62c7c3aa887fdf3089d857558003e589aba9add6eeb890b8eabdb607c091b8cf1eb8e1db78f29b1828d31ce091724767c31060b

    Score
    1/10
    behavioral19

    • Target

      Data/window.dll

    • Size

      81KB

    • MD5

      0ffa9a91901802310213d0ec9f021b85

    • SHA1

      499fae22c319923543419e245fe1f15582d9428b

    • SHA256

      c688b9b6d985c575d851547937baca2619f11a23897bbd88637eec311fb7e20c

    • SHA512

      1ddc8755667b5b0ccf6d7e03f35ef1435bf00a121c8b31c78bad1dff072f413fb46845a643ef06085d3d8bd2a27433746fef1ec760fff1a0e786eca76e8d5e21

    • SSDEEP

      1536:gqmvPM/qa5MzNixsMTum0OuGZ0c85wsW+FcdSEOAO7wnZl/hZ+n:gqmvXa5cixsMT/UGWc8MSEOAO7wnZl/6

    Score
    3/10
    discovery
    behavioral20

    • Target

      DialogModule.dll

    • Size

      267KB

    • MD5

      451b7a3b34b2f89245ca6f0d2bded607

    • SHA1

      e7115371c0d475a2ba2ddd8d5b3e6dbcc74c2332

    • SHA256

      71796350026238175c0efdaf82b208fc585e6c7d96fae234348f4a2e5ad5bf31

    • SHA512

      3f17e26e617887071635eaa519e699025b6182f502c13cbd60ab7d0af0260b8aeba77272dca2428de5724a2d36552e34518cecaca2fb4207fb6594aa345810bf

    • SSDEEP

      6144:KLq7wEqARVYSu+rIc0/21ngSAOnJ2/tc:KEwEqARVYl+8eStc

    Score
    3/10
    discovery
    behavioral21

    • Target

      ExecuteShell.dll

    • Size

      95KB

    • MD5

      988b9f3a213e2a1828ee08e1678ff173

    • SHA1

      09ab94994fdf50264f6428557696890630bede27

    • SHA256

      460bb138fc648c9322ee6468d02a7da4c99496a3fb0b15a6848a22d5d6370053

    • SHA512

      19793af14868d3d67f010add3d49a46fb736e43a21111562ca6e898d0225df29b53cb64d137752ef758b992364b2c546f5d5a5ab78e971c9358509d6d6ac0d6b

    • SSDEEP

      1536:staMMMULe8pPBDQlZmisG9qG1cVKHGamBysu4hsWs8I7ucdmlUVV4NLkq:+FgLe+RGpMG8KHG0j4ImloV4NLD

    Score
    3/10
    discovery
    behavioral22

    • Target

      FileDropper.dll

    • Size

      177KB

    • MD5

      c841727e1c610af87da95b9e64a31eda

    • SHA1

      203bf4ecf14215488bab547d81a8fea3af754bf8

    • SHA256

      b13f402b984388b8dc627eafef301b7141f2da48defe517fbcd662bedfacb050

    • SHA512

      eac05fab9f0eb3326399ec7918e2b177940e0beebcd0f0e7f3257aebca00c4752da6e36870277ac4f1ba67255105a87ba55cc08c6ec9c40f85da0fc95d0c5463

    • SSDEEP

      3072:v/RZ+tl51T8b2/4JwMQva4BzeVEf0GjPbFqu6xAg0FuDpU09KKW1yS:vpZglHT8aM0C4Bze+0mBkAO139KKW1z

    Score
    3/10
    discovery
    behavioral23

    • Target

      Minecraft Note Block Studio.exe

    • Size

      15.2MB

    • MD5

      f59330f3e9be9f9b700a387d73b4bd20

    • SHA1

      f426bc953200341d073cf836ff806756f9315035

    • SHA256

      766cc85b942faa30fdad76ced3b0ef1af2b09edd74eab09c6384db6f3bd7bdab

    • SHA512

      373d2773d9e64ffa8e88f3bd9a4b5ec661856c99ef8f1421c38c548baee1348cbe4057128e6457790156820830fb358792a78bda6a07e465009d3afb676a3092

    • SSDEEP

      98304:ZmHeNU7b4PIPMIkaF0JnyxCzCmqz2o5Dq76ZjF/CCMSeCiCDD+k2mChBcCGVjF:ZmHeskA08FfXmqzd8yVPUmJ

    Score
    3/10
    discovery
    behavioral24

    • Target

      NBS Player Mode.bat

    • Size

      50B

    • MD5

      ace21ce50bdcd4b2ffe45af6244779f6

    • SHA1

      f32315a989adcc7e4dd588a23f4b3bcf74f714e6

    • SHA256

      059abac1515316c2be0dc776b2e9820f45bab91618d766b6a0c1afe40ebeba00

    • SHA512

      5862636cd418d16ffca5132c7727c9697dce04c8ffa0f50c891e5b36b121533a0e481a97a04eadae0f8ce2879b1d84046338fa225e00d9379dbd3a09d15a2d5e

    Score
    3/10
    discovery
    behavioral25

    • Target

      NekoPresence.dll

    • Size

      60KB

    • MD5

      4bf22144e0cae4f5fd4d5dce771e653a

    • SHA1

      e797aac2e6727657b041fe4bbca0221916e095d5

    • SHA256

      6c27390f1a332a42a712162f6e2750177cdc37f58bf1ef7a25ab6c4650edcfce

    • SHA512

      d6c1cfdd4be65f003af8983d2281befaa94bfc8dbcc12bc2c23f149ddf54e9fe878bdb54cf2de3ea6a8a0caa7c098303dc8e1527634fc82457f9637266033be5

    • SSDEEP

      1536:cnVQAxdA2bXXXfQPNK0meQgKVXyLwkHmkfx/lQajEld:cnVQGdA2aMe7LllQajEL

    Score
    3/10
    discovery
    behavioral26

    • Target

      ffmpeg.exe

    • Size

      2.3MB

    • MD5

      3146886e5be49ee98f1ea2c58cbfafc3

    • SHA1

      ce3a46795db74903b82ef02fa8874d0e85f01700

    • SHA256

      05a92f69e40a95976f3d30e07d4d86c014a6df9c443650ae5e713ab6afa1e63f

    • SHA512

      dffd44e97ae19ea83711b656a2aa04c51a2f31314bf2b640a7a9aed0fe2453b85f5fc4fbf6b5e534f279367672e1f1254e26b03fb9a4f1eb19d28712e5370eef

    • SSDEEP

      49152:KP5XTwaC6+MQsMiM4oOXUmfVM+vgMTwCS8DL3wEndm:KP5XMaaMvMiM4TXUaVMIgMTwCS8DBnd

    Score
    3/10
    discovery
    behavioral27

    • Target

      ffprobe.exe

    • Size

      2.3MB

    • MD5

      9f8cefcafdef38c4e81240e52fcd3a3d

    • SHA1

      441742f03401f4846cd00fdb4a360083d59cf233

    • SHA256

      39037fcd5d12cb0037e5743c7e9905954d0af1517b28e37d75af51dbbc1082a0

    • SHA512

      7fec60bd9bb12eb39b4238ec184f0493ab2e850160ebe0caed82a01e611ff4072fb8af0c781b2a6ea1696ced32b4df66a123dd9338a8d9ad1882fda0141d6ac6

    • SSDEEP

      49152:vFJXu4G4MCd5KgepmfCHLybvfdS1ynY1wg4dm:vXXu4BMCd5nepiCHGbvfdS1ynYn4d

    Score
    3/10
    discovery
    behavioral28

    • Target

      pygml.dll

    • Size

      80KB

    • MD5

      0f476d1eb02ab2e2a6fb8a5e74f7a3fe

    • SHA1

      8cbe497127deed82e13fdffc948a48cb6b6a72b3

    • SHA256

      fcd4486c4e8a8278d6ae26f4d2b23e0ecd4c5b4d0b60457f3208876637154416

    • SHA512

      d4ab4eba2384e2e222fd7b902986bebda68784db4b234c90631faa2eed9290c00e9cfafb87b261ba525f4da43c9036d013ac873757e0e134d50ce6df0c3dfd9a

    • SSDEEP

      1536:iipB5FEzROiZCJ+cUmPtowDWeYJ8dBblFDTJh9qxD:ii7EzROIZL3wDLs8d1lxTJh9iD

    Score
    3/10
    discovery
    behavioral29

    • Target

      python38.dll

    • Size

      3.9MB

    • MD5

      9f8e0de6e7d4b165b4a49600daacc3b1

    • SHA1

      8cf37d69fdaf65c49f7f5e048c0085b207f7287b

    • SHA256

      a9675a91d767095c9d4a2ae1df6e17bdb59102dbd2b4504c3493b0bcbed5ef55

    • SHA512

      3201b7adf94d3f4510e0b39b4766d1314da66662819fd6de5f5f71956750bb4fdf4228b6e1ad9d4d3bc1fdeb99b7414ed2eff0374aaa3216b67eeedfb8673b48

    • SSDEEP

      49152:jHQHfHn2kP/RYwV7hatjc8R5euJ0IAtOEsIUFIHBcn8MTPGRaTn7Hk7+K4ddmQz:T0FYwV785N2IOZUeHS8MCRqA+xAC

    Score
    3/10
    discovery
    behavioral30

    • Target

      uninstall.exe

    • Size

      90KB

    • MD5

      f5646188f5baf7bc59c700b7c01befa1

    • SHA1

      5f5a3c36742a327e48d9f98f6438b20965ee84eb

    • SHA256

      937e3c58a791330c0e035916a9966cfab6f5e9deee0d44be8d4e144073a77206

    • SHA512

      285ef47515b49e235630df5d4f64fb6a394ffd4e285f2624a738d4d515ec9e85679834610d60e5a4c314124cf31bedfd41c685f8d19a690d13896a6dfb5564c7

    • SSDEEP

      1536:GcVxMtkyfWqPG1QIcVdWToWw2hgHJlnqbl6W2adu7328M6huLeAyNsfBI:G4MrfWdbcDWToWNhOJlnqbl6W2aduz2E

    Score
    7/10
    discovery

    • Executes dropped EXE

    behavioral31

    • Target

      window_set_icon.dll

    • Size

      79KB

    • MD5

      522fc21b6cfb771e2a1180b9df822fcb

    • SHA1

      c81946d5753b32fd2e4e282a1c5cc6a7eabf86a0

    • SHA256

      ba5d14484827c3b7ee03b68dc46a6022993c39735376f10c3f559c96955705f1

    • SHA512

      2a6d2df6abb8e5ee3b23f0adfa84ba87aa52fbfad3a8087510e7e1e2220824c0ee8e7c44efa4fbd6e47ec3778e2160677c3788c6e999d132cb7fd9d0976a2fa7

    • SSDEEP

      1536:SyvPdxomTT6SFKbUCK71w2MBuuIufR1rhZmK5rsW4Ycd54E+3gY5:SyvF3TVKbUHw2MqufR38U2554E+3gY5

    Score
    3/10
    discovery
    behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Peripheral Device Discovery

2
T1120

Query Registry

3
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

Score
3/10

behavioral1

discoverypersistenceprivilege_escalation
Score
7/10

behavioral2

discovery
Score
3/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

Score
3/10

behavioral13

Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

discovery
Score
3/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

discovery
Score
3/10

behavioral21

discovery
Score
3/10

behavioral22

discovery
Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
3/10

behavioral29

discovery
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

discovery
Score
7/10

behavioral32

discovery
Score
3/10