Overview

overview

8

Static

static

3

Adobe_Phot...24.exe

windows7-x64

8

Adobe_Phot...24.exe

windows10-2004-x64

8

ControlzEx.dll

windows7-x64

1

ControlzEx.dll

windows10-2004-x64

1

Hardcodet....on.dll

windows7-x64

1

Hardcodet....on.dll

windows10-2004-x64

1

Languages/ilocabu.ps1

windows7-x64

3

Languages/ilocabu.ps1

windows10-2004-x64

3

Languages/...to.ps1

windows7-x64

3

Languages/...to.ps1

windows10-2004-x64

3

MahApps.Metro.dll

windows7-x64

1

MahApps.Metro.dll

windows10-2004-x64

1

Microsoft....ll.dll

windows7-x64

1

Microsoft....ll.dll

windows10-2004-x64

1

Microsoft....ck.dll

windows7-x64

1

Microsoft....ck.dll

windows10-2004-x64

1

System.Win...ty.dll

windows7-x64

1

System.Win...ty.dll

windows10-2004-x64

1

YLLibs.dll

windows7-x64

1

YLLibs.dll

windows10-2004-x64

1

wdmode.exe

windows7-x64

3

wdmode.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2f5e10ef3812f509e3b50a65edbda1d5eb356430baa8c555476308fd99afb2fc.zip

  • Size

    12.6MB

  • Sample

    241104-cnkdhs1erj

  • MD5

    b4ad64376e72452612c3d6ff8235e9f4

  • SHA1

    b941a006a41037a9695a3863adf69605e72f962b

  • SHA256

    2f5e10ef3812f509e3b50a65edbda1d5eb356430baa8c555476308fd99afb2fc

  • SHA512

    5df89e03ffd0501828d5bf5031a868c51b3f8ce2f3e5839f065d8740b74e4bb3e308ae2d3bb9ccf4a5e2ec46a09809f901165432ffd716b8218f25a7171a59fd

  • SSDEEP

    393216:jYYbPNCxpW+SfVxFxeycEQHIwlCd/lhYl:jYYQEfRxfcnHIwodNhe

Score
8/10
discoveryexecution

Malware Config

Targets

    • Target

      Adobe_Photoshop_2024.exe

    • Size

      376KB

    • MD5

      a8bc7fb55a324f1ba1c7807b7c1c4f29

    • SHA1

      9286664648e7629ff1cc35ca030e22a45a913c9d

    • SHA256

      f17b6dc2f1dc25b982d1d3da8601121a1f21e16be3fe406d3cff62100cf7562b

    • SHA512

      726d8dca09ed5173f17a7c271cfb8faf6e83547390a55c7afcca6213c25da0e5f55599616b65b297ddaf606d0c2194ef98e9df9a45490950f23a0a3c9bb1d534

    • SSDEEP

      6144:CNwt6ykfy77nrjTPhSVQBFD7sxBUXEe9OmGC0GoOwwmVQBFv6jOjK:CNwz3nrj4QB97sx0d9OmGcwwyQB1OyK

    Score
    8/10
    execution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

    • Target

      ControlzEx.dll

    • Size

      181KB

    • MD5

      2d5035cb5a3678f2c2f5a889bd384813

    • SHA1

      9c4a669a30a4bf0e27d5b373919c3f6017c8ec4b

    • SHA256

      424cbe8f24a62c330149dbe0b80e214a984950c3b79b067058671608229fc2ed

    • SHA512

      fda0592126c9b9835380457e1f55d984cd5fc7649be172a0de17006e60d05687fbd5454a5b3adceb4497f6bc7a780d15dc09b70fd642f2db792571e996c8f56c

    • SSDEEP

      3072:3E0E4PCRvy5/ixiBU33nC0bZqSSvKKy/f1SV666AjwbbHyH6engMHdFtp04M9Y8e:3E0E4Pyy5/ih3zbZqSGy/fk96e9Ftppn

    Score
    1/10
    behavioral3behavioral4

    • Target

      Hardcodet.Wpf.TaskbarNotification.dll

    • Size

      66KB

    • MD5

      d5d708e9e7625ab2c4ac1c1faa099350

    • SHA1

      9436c35fb72c4fd0ae1420effdbe5a8a14326077

    • SHA256

      f6fadf0375d22512b2b3f075362433c0de173adfb290b4d8999cdcb7acedb0b2

    • SHA512

      0321bbdee6a11275fd0f86696e0b244ac0415ca5cb64cdd0230bfee028e550587929c5d03402740307fa7b5370532d2e3c044b85838489a72f29ce1748fc093d

    • SSDEEP

      1536:KfgDdceepOS3u594ww89rRwjwPxvjLbPxHZ:KfgP59Fw89FwjgxvjLjx5

    Score
    1/10
    behavioral5behavioral6

    • Target

      Languages/ilocabu.txt

    • Size

      1KB

    • MD5

      0e95fb79c2c382823fdb8e7dc1564155

    • SHA1

      66cb168c24e689e68b0dc9276f59ae5ca300955a

    • SHA256

      988164c46c08c601045f1043f4c1b923d362a6022c2f8a058112dd73197e3c09

    • SHA512

      aeeafe4e1a5c925477855c006625abcb31828b083181789b55fcd8c4e839a97a1310cea6ab61ee83755f6a5d41912640c611f072eff260943e3040d561d6872a

    Score
    3/10
    execution
    behavioral7behavioral8

    • Target

      Languages/pangasito.txt

    • Size

      1KB

    • MD5

      9e9da1fad9125e889e6cc94cfc25fb03

    • SHA1

      dc48d868076fd7d345566b642631e6eb572f5946

    • SHA256

      73430d1a4c477b9deb50052499886904c819ed8f3b0944e722b699602956c939

    • SHA512

      9e931c36ed449ba48fb7eb4b0e17f535d259f744f30f5b3769842a1e088ed25f2432a2549f5aa1c28137b391cf3ebfa30fce7c094fce68eefff6d9a3e9416df7

    Score
    3/10
    execution
    behavioral10behavioral9

    • Target

      MahApps.Metro.dll

    • Size

      1.1MB

    • MD5

      3fbb5451b2c79a645b1307d656770319

    • SHA1

      0368e6f3f3d80af3d170c4f3f9e427d3d81ad331

    • SHA256

      3f42846b251831ff8bff34860d903065500a15e5e9393d714bb63edb7b8e298f

    • SHA512

      cc064ee1075a6b65c57fb66fe7e703883356f243ef72f3d38225e098de14abba8c87efb984d430d4c92598616e00d6b409fb0a1c8bb054ff63eb8e65cb9a1e1e

    • SSDEEP

      12288:YQnvcpOCgsu4dNs9bWKNxV/FZLv4IS7gG2QiH:Yy0Jgsu4YwQxV/FZLv4IS7gG2QiH

    Score
    1/10
    behavioral11behavioral12

    • Target

      Microsoft.WindowsAPICodePack.Shell.dll

    • Size

      552KB

    • MD5

      18a46202a1636b985208e2183d756617

    • SHA1

      7f8d0ca687ac82067d7a79c011a2688336b71b82

    • SHA256

      513d386fc084ad355d1a8668d8b4e43cc3b21f135ac3eabbc6b96adeb3ee9e84

    • SHA512

      70420dd03f338201801afb0ea2742bb08cd860192503906734de7306d1349a5524a12fc45c84dfa2e38f1178c3ad62a8656a9bebcb2bb5b9ff02f0f5543ea851

    • SSDEEP

      6144:vtIgLGv5WBfXkYlsL/Nz++R1yji08n3uzxRQKEPmBm9C5vEx3tcQ8Vub8xPtwZEH:nz81Dn3GQ/9C58x3tWXH9gvHYF9

    Score
    1/10
    behavioral13behavioral14

    • Target

      Microsoft.WindowsAPICodePack.dll

    • Size

      125KB

    • MD5

      ace419174e1e0c792d028f25f60d6e5f

    • SHA1

      5325579a4d960fc09c359c2ec7f2b03a27a9a698

    • SHA256

      90d56b0a1c7e631e5a12985f9b7cc943a1ebc31e40ec53d56dc9149bba74ba24

    • SHA512

      53177394027846161c296a25527f266814157430c8620e474ab1c2f6b2b54f7c401a4db087ea26af7e854ed07a006413e99f0384e06b1b4b194acb61981c5542

    • SSDEEP

      3072:QfBa6TWUNuRhicznzcSZRazyDG43vjyMcnFlizejgxKmjkx7:VUNuZjAI+mvuMOj9mjk

    Score
    1/10
    behavioral15behavioral16

    • Target

      System.Windows.Interactivity.dll

    • Size

      61KB

    • MD5

      e991d47605bc04629af29939ac2cc9b5

    • SHA1

      70dcb9c81d5c8351d19d3a3fbc5530085ca8faff

    • SHA256

      eda12487c479ff31202a3c60f88f1f0e2bf7392919099315d0d951683f14609c

    • SHA512

      25355edf41f7e08b1a725a920fcab7c04d4c91c3c015a8a9ab6c7d1224b5f3f83baa81f867167369ae91a8f11f317e9a3a1092348ee4e44f89dd8b086a67f2ca

    • SSDEEP

      1536:23wBccZdxuB8mQen6JxKjrlMZgR0Eo1jwPxb/JjAPxH:wcHmQPUk1jgxbBjwxH

    Score
    1/10
    behavioral17behavioral18

    • Target

      YLLibs.dll

    • Size

      36KB

    • MD5

      3744d4fd7ba093923174696b56d05f9f

    • SHA1

      f5ce183eae50c86baae034aed1ce11c0ad15fecf

    • SHA256

      3101a828d70c878e777a15ebb522b6a2f82e30fb2217ce66df0f161a57656301

    • SHA512

      2269e1b99f2998accb13a23f55806a636edfe374ab14ffbe93eb653868b935b83ab38c998905e8878156f96b4f2c85c18bd61fb374c9079eff5fba7cf6ec9800

    • SSDEEP

      768:3/ImTZNNBGXjO9hwjLZEJPx4SjL8PxWEY9iYX:pT/u6wjwPxvjoPxm

    Score
    1/10
    behavioral19behavioral20

    • Target

      wdmode.exe

    • Size

      574KB

    • MD5

      42badc1d2f03a8b1e4875740d3d49336

    • SHA1

      cee178da1fb05f99af7a3547093122893bd1eb46

    • SHA256

      c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf

    • SHA512

      6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c

    • SSDEEP

      12288:myyKdVnyNhXCV4EkP7AIfzNXZ0b5NrnkcAqIV0A1caRI:mKvyNhXCV4E8BXAfrnkcAqU0A

    Score
    3/10
    discovery
    behavioral21behavioral22

MITRE ATT&CK Enterprise v15

Tasks