General

  • Target

    VideoThumbnailsMaker_64bit_Setup.exe

  • Size

    22.8MB

  • Sample

    241012-a3wnzsxeql

  • MD5

    4ff21725bc66ecbf4260dc085490e806

  • SHA1

    40da3be578b6a174c79f43c8df3087c24eb5d78c

  • SHA256

    1173af60b8b0b350632ded58fd89429fd9457840f418ffa214f57487768ab19a

  • SHA512

    952f9a67421a1a07deccf14f8fe60255c56868c488d0259c839c605f6d3ed05aef20cf4f1183011f860974e75ad8b8b47b7bdb6fad0b9955eefa4bb13ea62307

  • SSDEEP

    393216:JfL+jO7JCQ+MD3ZJjupJpG2/PhcwCg8Lu1UBh6a+ZPIxVBdXfYQBG9OjhCU04CWD:JfLDCQb33jUv4pgOx6VlIhhBG9OjwzAL

Score
7/10

Malware Config

Targets

    • Target

      VideoThumbnailsMaker_64bit_Setup.exe

    • Size

      22.8MB

    • MD5

      4ff21725bc66ecbf4260dc085490e806

    • SHA1

      40da3be578b6a174c79f43c8df3087c24eb5d78c

    • SHA256

      1173af60b8b0b350632ded58fd89429fd9457840f418ffa214f57487768ab19a

    • SHA512

      952f9a67421a1a07deccf14f8fe60255c56868c488d0259c839c605f6d3ed05aef20cf4f1183011f860974e75ad8b8b47b7bdb6fad0b9955eefa4bb13ea62307

    • SSDEEP

      393216:JfL+jO7JCQ+MD3ZJjupJpG2/PhcwCg8Lu1UBh6a+ZPIxVBdXfYQBG9OjhCU04CWD:JfLDCQb33jUv4pgOx6VlIhhBG9OjwzAL

    Score
    7/10
    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Target

      $PLUGINSDIR/DotNetChecker.dll

    • Size

      85KB

    • MD5

      7ba49f3f086dc16a2863b0f9e704916c

    • SHA1

      a3045477d3af46e31d12479f02a1b64666ba8be2

    • SHA256

      263fe61f2f50cffa5356af07b027a691c6640a04245e88ea9734dd84bd735289

    • SHA512

      3ea076b68126a7d451703dbb58f616bf272788fcbceb02c6b12855fcd4f204c0a94a4486b73f4daac6002a74f4f0f51f941654ad11af56ec38e5eb6cdd3fcb2d

    • SSDEEP

      1536:X/Zjm/1nZ12+XrMX7uf9RX22LurfSECjSeeWSKQUDs0OsWPIcdA2kUlTeJ:XyQ7I22Lur67jKKQA2kmTeJ

    Score
    3/10
    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      564bb0373067e1785cba7e4c24aab4bf

    • SHA1

      7c9416a01d821b10b2eef97b80899d24014d6fc1

    • SHA256

      7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5

    • SHA512

      22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472

    • SSDEEP

      192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL

    Score
    3/10
    • Target

      $PLUGINSDIR/UAC.dll

    • Size

      14KB

    • MD5

      adb29e6b186daa765dc750128649b63d

    • SHA1

      160cbdc4cb0ac2c142d361df138c537aa7e708c9

    • SHA256

      2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

    • SHA512

      b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

    • SSDEEP

      192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs

    Score
    3/10
    • Target

      $PLUGINSDIR/nsisStartMenu.dll

    • Size

      5KB

    • MD5

      8cc6e3eea71d040f30a3fe34c00b27fe

    • SHA1

      94d06eac6b90a0e70a3dc039233bfbf0bd1f08a4

    • SHA256

      bce8f1df36b787963bddb6496f44a148ba1a7b56d4c2a02f7e059f2258b1dc0c

    • SHA512

      e030918b5660f51b7f77f342bfcb68d5d3749f997e45670558b153ae0cea76c508788edffa555f1a24d6934838db989a8333e76a9869e70a89b0bc2df71c9ce7

    • SSDEEP

      96:VvX4nc1PgE30ne9N3ErdfUQhVEZCytwZCPBCkeHUnL7XzZl7C/l7CRR:5Xkc1vEne738mQhKztCCPwfUPzt

    Score
    3/10
    • Target

      $PLUGINSDIR/nsisdl.dll

    • Size

      15KB

    • MD5

      75fdbfddcb769095e6143eb46cc77e26

    • SHA1

      a1fed5cedbc3c3319e332ae3f5347319af1f3f18

    • SHA256

      e2267f1a80ca42fde50e6b22f39821334a9ea622995e0869d3709b05306b1126

    • SHA512

      3ff5485f7a3c35e55b94bd09019555945ab4fd9fe03cce1ea9c43bd2fd75b0a9502342eb36acefe16a3ebcd9efc1c1eeea2b9621d31baa27b035ce60ffa1f3d8

    • SSDEEP

      384:bpy18oahashajPmIYInUJggBOZgAHhUKijb:bpy18oafmeggBOCAHpij

    Score
    3/10
    • Target

      DirectShowLib-2005.dll

    • Size

      276KB

    • MD5

      4386f1c7558af3d3cc32b8a84b98bb90

    • SHA1

      805683789ce64f78604a6fe3df9f9a5051da92b7

    • SHA256

      6e9723fd0f6c00224101ff646db6af7f3a3ae042c79e667f1be849be95038aa4

    • SHA512

      91f2d81028b0b2b6fb6e6386e90717ee24972177ce3533b71c6554c887e7f2058eba9f9fd34737c3e3cc8f41ac0f570ac16ad7180f83a33ed6bf58b710cb97c4

    • SSDEEP

      3072:ifblNAZ8diV8jneoUFXi/fp2qD57NcW3f+UM2Il4BcWapno9kQ453oYM3Kvl5:i5cM+86ojxj5ZcW3f+UM2Il4BcnpuKv

    Score
    1/10
    • Target

      FFmpeg.AutoGen.dll

    • Size

      617KB

    • MD5

      7fa3f0ccb2ef991056714f7a69fc2bb8

    • SHA1

      13d24c4ebd772d6699ff7cd087d3702c8eeb52a3

    • SHA256

      d542d106de769b2b54ec3089932eaba9cd5c28d88b528e0f4632ff99473ee585

    • SHA512

      d380c6d782ad494e6120a9a61b0c8f452a36100701433495609e6941cdec8709cddee8baf9066c1cf743daf9c0ada37a4ad8960c225ffc5bf943bb59bc1cd759

    • SSDEEP

      6144:nIWVsiw5xxff8s5UCwJrPw1kU4LinqfD9AGaLc4hRPEuRjIPDYFZKWm6WK:nCb5jcTDU4mnfPEu5IPDYFZbm5

    Score
    1/10
    • Target

      FFmpeg/x64/avcodec-61.dll

    • Size

      33.5MB

    • MD5

      a3f5721cc87ab67fca5c564e793795d0

    • SHA1

      be5496d1a764f068c227e1f87d810baa5e38d44c

    • SHA256

      0d7068cbc534877bbc54c9d691c8fdede81156b9e1bd2574f2ccf1e1b6921d95

    • SHA512

      04f377c2d13acee138015d5f307a31bf4197500213a003e29d603a04b567c1d169259e1f95636b65637b286e177f0f5dc68e0b1767c81e109d83f0b925daeff7

    • SSDEEP

      393216:VEW4yIrFMa3k3GPbvxW6Idq2Z9oDxZBRM2dnckjnXHka+Y:+W4yIpSkWU2Z69Z4ruXH4Y

    Score
    1/10
    • Target

      FFmpeg/x64/avdevice-61.dll

    • Size

      616KB

    • MD5

      e9008be1118cde19812b483cec65b3b7

    • SHA1

      e840c3bf6904341eede248cd6bf9ab5e6da6f657

    • SHA256

      1528de689eca2de25ef71f0d0ccbc75ba9fe5ea0d833eb5311d5f8dec8e811fd

    • SHA512

      61b86495635fb5b4e992de2c1632b0a15e79411a6384a75324a3b624f896b14f03a13fc6845e3e9659927f3bc2a7dbac36394480e1a6d87c708fcdc7c468bfe8

    • SSDEEP

      12288:vifil5YEZo9B3fC7PvDaGlC0gPW995YxP:KfiAKs5fCzzR99exP

    Score
    1/10
    • Target

      FFmpeg/x64/avfilter-10.dll

    • Size

      6.5MB

    • MD5

      fceccb6e09605bf0bbbb53e306d634af

    • SHA1

      bb736e004bd15742f4e54f12ac89d50895cfdc42

    • SHA256

      f7d4949c0815a8fc7c503a31130690b1422044123cee98f2c73060b5d85b4683

    • SHA512

      d03aeb3e8bb7455640e091d398d85b5270ea10de94d6836c6007f55bee3e477a7fc1dd331df704b0ef772c5ed8056ffc3e682c159e3473961d5e246d5642d8b6

    • SSDEEP

      98304:Hm8gUCkbFnquJW8pW9AVB1YPYqdVhBznR/qDa9EMgZ4:RW8pWxPDJld

    Score
    1/10
    • Target

      FFmpeg/x64/avformat-61.dll

    • Size

      4.4MB

    • MD5

      ad64f8bac274a6feffaac8d335c8bcbf

    • SHA1

      b616139ff431018c88e47d02614bc567af298d4a

    • SHA256

      3a18b4e54cdcc82ca89d961c20d8fc0124e5576c2fbc792252e95aef27d0745c

    • SHA512

      3691df7f0f774d702b03221e3833a2273860094917168fbf6918e856cd7dcaf528388911c2af8fe028e4b9e0a2574f8b125446cc64c142ea60bd37c014f6f4e3

    • SSDEEP

      98304:eiUpKtT9FVtS0t2lZg0ZciBAUZLGq2KrtRz/qDOD3Dqa:jAWiVVLRT

    Score
    1/10
    • Target

      FFmpeg/x64/avutil-59.dll

    • Size

      1.9MB

    • MD5

      0392bb56a6b25dafb9798443b781359a

    • SHA1

      cc05be0e4f67d0fd90b7aa4fda4d84f68af63d2e

    • SHA256

      75210a5b6201dd23ae95bbd11d5465a594c84fe03315f6337d76e1ad7284738b

    • SHA512

      1e492d5c863326ead3e3dac2615d13806c0a194788950d777b5b8ab8a2cdf398db340b0a4ac18ac1cc59ed88603ce3325ea2f1573608e3b584b6dceddf6e82fe

    • SSDEEP

      49152:PKsigIyeyfF4QgOqZ3yMCaO2pY/q/ADYZmU4:ysiv+lqJUoY/q/ADYZmU4

    Score
    1/10
    • Target

      FFmpeg/x64/ffmpeg.exe

    • Size

      417KB

    • MD5

      4189a33aec1259427361cf0457150302

    • SHA1

      bc7354e59861c93e3d3355d5dbac5d67a7a88559

    • SHA256

      b31020247917868ac819222facfd6389e330be384729b28bb6722a84a8d8d7d7

    • SHA512

      6d0068ede460c538965bd1328bb80b28aa6f642b656d4e240ea70d1aa5cb4e21f29f90b74f4bc2f752bbb360fb292ad4f0346686feed0ce67cc006493a976be8

    • SSDEEP

      6144:JVj46MD/Y8xiLBGNNVEoS5LvkmpNGSmtkY8sjgYQRLFQ8qagS4bmx:JRufjNjEtZmtkYtgY6F7KY

    Score
    1/10
    • Target

      FFmpeg/x64/ffprobe.exe

    • Size

      198KB

    • MD5

      b67614a3cedea08a8f30bf1726355c71

    • SHA1

      76c3497adb5e01b73c4bd703a34760b111a6c153

    • SHA256

      08d4dc26a074de1c10a6e4285811d6e91cfca37713e062f7683ea646b04369e6

    • SHA512

      c09e232513d476dedbd6bcfab6a993499a95f858b89d5681163c2772d0ccc6f7b5fe5b662dbf9bc2daf1883bc99d4f7c48969d73c451933ec98948f6a6d131e1

    • SSDEEP

      3072:/Ceqyu2z87W/0EeTatRDNWZ8lQJZUJZdt9pcqsrsUMqaDqTYbTv8W2y:aauZ73EptRDmBUJzpcHwfDqTYbTv8ty

    Score
    1/10
    • Target

      FFmpeg/x64/swresample-5.dll

    • Size

      239KB

    • MD5

      9dfa3bb531cac53cb059e17e587e9b5f

    • SHA1

      f2ca953002cd42764bfba1a136e4ed6dba66c43f

    • SHA256

      48f1d4fe98ee50a8717d4e14c51d77b70eefd2d19c6080afd26aaca87c3f662c

    • SHA512

      7f1cb77b68b7ffc378320e2d836021cc1e06b3ef3aa2c410bda9bf2d39267e2b9b09236ac5ef6700a2eb6d0d3414712f4b532535ca9ac8a69a71fed83d25b40e

    • SSDEEP

      3072:rSJK3jNIfktcJPfGOWBloTQI93rbdwYuz0UTkHtQja:rSJK3jNIctJ1fgZgkHtQja

    Score
    1/10
    • Target

      FFmpeg/x64/swscale-8.dll

    • Size

      874KB

    • MD5

      9693f46b34674953835307a3b9b129f5

    • SHA1

      81fc4c3dcd42ecfe9c624036cb45e7ce01351ce9

    • SHA256

      dc03d45747c6900fc3627028ac49f0391b1a2cbd7173eb598ea0c7a32b127a5b

    • SHA512

      98bfda1fc2b6c8e41d970c31709c37283eb52a62e730f9134df47ec122644fc42ccf7c2cdf87dfb2a84df916409345c2020d500549bf56ff1e15395e04cd3f93

    • SSDEEP

      24576:6RvgRRvLKGjzJpSRibhOcRDDAduav+tGUB5Gnc1YoS6/SJ8RUE8v1krJpAmG9g+q:TtGUB8nc1YofdRUE8v1krJpAj9g+AJd5

    Score
    1/10
    • Target

      PicturesThumbnailsViewer.exe

    • Size

      1009KB

    • MD5

      bf6aef8de1ae9f5393bf7736beddeddd

    • SHA1

      a640b843bbf4d950ee88fa3dd8356d9a13acfc3b

    • SHA256

      a90e14860740acdee245d9584beaa2a9ca3927c14ce6b9bc3e64129aa5596ed8

    • SHA512

      fbefadc80ab77e716e8e59a4edfd3025e61af3060a3168c512c9e978232b6370c152b49209f1ca90fc06283fab9db173f710d25bc8e8d304924f7190c5759f74

    • SSDEEP

      12288:KdZqK2Vjqr/eduz6hNoIgqQpLI5cD7Z16FUvmZ19ySCFXzx4IfcTorjzeyKzVNHy:+0N9qr//WsI5QJ1j2ud

    Score
    1/10
    • Target

      Uninstall.exe

    • Size

      50KB

    • MD5

      b87a591ae4ee7e64c0bddd5867a79009

    • SHA1

      fd249bf71bdf4e999ae60ffb267f6b8c055e58f0

    • SHA256

      778e7de3d32f4af915b5a85db7c1a5da1be748ddc810eca93f34d066070ba02a

    • SHA512

      cd87e3cad3adfc2a78cb6e6bd16c50903b0b54324dd400ff7b686e5d5520721208e0b580e21265d219f7ce77bcefb5e7a05b7b70cfa1b7dfa82f3e1ce5fb1196

    • SSDEEP

      1536:iQNRwF/6HWFDw2ShOp0DiJkuytDq+HMVKNo:JNRCywDw1DiJkuytDrbW

    Score
    7/10
    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Target

      $PLUGINSDIR/UAC.dll

    • Size

      14KB

    • MD5

      adb29e6b186daa765dc750128649b63d

    • SHA1

      160cbdc4cb0ac2c142d361df138c537aa7e708c9

    • SHA256

      2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

    • SHA512

      b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

    • SSDEEP

      192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs

    Score
    3/10
    • Target

      VideoThumbnailsMaker.exe

    • Size

      3.7MB

    • MD5

      dced938a33439b5e42a3cea767e54085

    • SHA1

      182f398c003ab78adda33e2f8df6e87acc48eb43

    • SHA256

      b1df30dae2829ee8ff1959eb2351b24b3c51242aa0cea5d1d38f06c8d16f7614

    • SHA512

      1465cc568ff79579ac50abc430e1a18387fec030210a79be484f5289fcf49285b139bc00e984dbd5e49188392be0403a8d60e80fe02eaae196a3402695b21b0b

    • SSDEEP

      49152:FJAHOWqn3X+2Zr8uuLib1GPQnxmefxsqIf:PWaPuLib4PC

    Score
    1/10
    • Target

      WebP/x64/libwebp.dll

    • Size

      590KB

    • MD5

      734a092ed4f0ef19afa4ec1f02c99c3d

    • SHA1

      f39aa89b7daf1f3a665e3197c1248c2e7b72798e

    • SHA256

      c4fe41f5cc7c14b227d508c24918f1fdf1d7070f2ee4292ba63d992ebbc3e3b7

    • SHA512

      8351424462faffa13ee50a06e8df6c963daa642a638d858dfaf8e84709b20ff71440a60accbe97597feaef401c483da6aae642f639b42fd174a9807ee898d769

    • SSDEEP

      12288:jVmNpAUggzyUNhO0SLrLrLrLcyfBPBduUoiq8YHyAL:jVdDgzyUefLrLrLrLcAnIUW8YH3L

    Score
    1/10
    • Target

      WebP/x64/libwebpdemux.dll

    • Size

      100KB

    • MD5

      c3b2a0746349cefa0f568adea460a7da

    • SHA1

      9949dbc5ef55a0b543cb45cd3a260fde98807fee

    • SHA256

      f674ecaedde36d4925c921e3179fef286bfe988510f3b86f62b34097ad80b0a5

    • SHA512

      1a8438737d458ce044bbef05df8d0b9d450d2e66238feff7453d7c5cc9938c049bb2ef00baeac8556aed24df239a22a416d057b80ef1255eb6fea2ff7d9cba73

    • SSDEEP

      1536:XXg+BkUBq4IOeINb77/SNIjnNdnmmjDJMiLJ4rsWMUd09dlypW/JRBwh:XXdkUBPIOvnjcIjNdnmmjRCO+M0sZwh

    Score
    1/10
    • Target

      WebP/x64/libwebpmux.dll

    • Size

      161KB

    • MD5

      d6d9f5dd1753fb8645ea47ca970a4dff

    • SHA1

      fd07e0897b661f796e7acffef4e5f9829c5915c7

    • SHA256

      dbee6d0e23210d161b0ff4361f84b6d22c896653369f80ecf430d6fd9e95ce44

    • SHA512

      bc408996d232f3cc7792d6e87333a3c627226325bc124dd10ac1826fbaeb71679caa42afe4aa23b7183e83a43b0021fbf48475cc798a70e8a5fa45a99762c608

    • SSDEEP

      3072:OCnt7MobwVgOyKweQ1lCLEIMlyJXTx88KoY4sfZHvuH50q:OCnt7MKvKtgbIAyJWohsOa

    Score
    1/10
    • Target

      apng.lib.dll

    • Size

      20KB

    • MD5

      fc0cdb99615548a5af33a6a69fe33c7a

    • SHA1

      d2acad09cdbf01803668cd7a4e2c92e3027a2c9c

    • SHA256

      71555b502f2dde963ec6713a06679af8220e0ff02bb8c728592db76417c8b48f

    • SHA512

      b067249bc545bba1d368d7a3eec18e73e587a32a8f01aed94bd388127f5f504aacf51894d07c2fdd05dac8117994eeafea33a2e6cdf915577e5f0a12ce6d19d1

    • SSDEEP

      384:+wHhmIP4027rzYQHX6oC+LZdfAxd4RDBe5Kpu1wjA5Ur6/UIR:s0zo9LZtAxd4R44416ASr2V

    Score
    1/10
    • Target

      d2dlib64.dll

    • Size

      113KB

    • MD5

      f16bdf3b1a8c10cb881188ce22ea3b6a

    • SHA1

      ddb30a04087a54c617557f947f64ce52d2bd7ed8

    • SHA256

      69e0ed5f7d5414dcc2cb3284e4b781ede8b74daa6d18a51e4a4283f3633e7698

    • SHA512

      522dcead38671afffba921bacc409033937c27e7d616fcd0cfdf2120de1e16cbb3efa427afbf0ecbad070604b068ad1d959a01eb470d8ab0043b90037f6e67c4

    • SSDEEP

      3072:xD9cWJSkqs3Qgl2cz7M9Oae0MmlqC67VBf:xycq2X2cz7EeS

    Score
    1/10
    • Target

      d2dlibexport.dll

    • Size

      37KB

    • MD5

      6656a0eb37bd08c6f3ab3de54309e967

    • SHA1

      85bc9df6b3e68ea9423c7a3931e58fd808023947

    • SHA256

      b40aa5daacafec64de83183099bb1ca404080a38947c7632fc62665ad2caf90d

    • SHA512

      8b5259cc57a35dc3581f3cb4b4cc9a877306e2e4093e4bc78e9fed98642208e9acd8cdd1515eb8c134768c7a7625eade95c8813ac38d66a2f1c40e22379f712c

    • SSDEEP

      768:i0uezsHh7VpFaZQ7uPO0h3lqIuprdtvVOrm3:i0vghPzbQr0

    Score
    1/10
    • Target

      d2dwinform.dll

    • Size

      27KB

    • MD5

      cb9ba4052c55aec167bb32af1a80897c

    • SHA1

      2c5df24f19e6e913cffa9bb59adef5267e4c5704

    • SHA256

      f6dfb4ad2f17b739a1b925def685b5b74fc95d87d0784bae5791ed99a6484549

    • SHA512

      699518850efb3c3d9ab9188afac57d5fdc1894545dee44771993879504fb7b701c2eff920b91db9eee33375293f71f6a67ce18035f9cbcb243ae8826e417aa46

    • SSDEEP

      384:mGwPUwXlqPekQ0AjThJa+9eTNZBp42cOq22e/7ZwpAWpaQ939c9Fm6nvbJBOM2BY:mTXqWkYXzT3e9FmyvbJBiB6/+wr2c

    Score
    1/10
    • Target

      loop.cur

    • Size

      326B

    • MD5

      9349e388af9859b16842b1eec9095142

    • SHA1

      e7e9def1988bda00d8be38b1c16bc1cc37312ec0

    • SHA256

      f048f4cfa8c2d895524358f77a0cae5ee3db15ee86a6a118cae37527ab460979

    • SHA512

      fa53cff0170fe287ea61c9bf689b9b28c58ed63bb32bcc82db668b40952d53cc67f4fd14ceec66c32f342440061456e363e79fa847b15f42449b4519b7bd230d

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks