b253a1dd0eef41a206dd2cc6aa21511bc149f5554c102e27b20ffae7ef3d08c1

Sharing

Copy URL Twitter E-mail

General

Target
Setup.exe
Size 1.5MB
Sample250930-1c8hzaymv2
SHA256 b253a1dd0eef41a206dd2cc6aa21511bc149f5554c102e27b20ffae7ef3d08c1
MD5 fd46437eafc8dbb84bf3b8776da857e8
SHA1 049a4d50d7de5d812e5b5c5367b056cdd0ad9303
SHA512 d6b65e92d9537b44b00a3f5afe1b8d89c2aae47fb3543316ccba1bc219e754d8df222d8820b7f4dda5150ef197313bce84901cd11b362b96368442e64516388a
SSDEEP 49152:yGUzMc8/yBNv6d2NW/TGR61uVYUyayqkmn4:yMKSGwTGU8V9yqy
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Targets

- Target
  Setup.exe
- Size 1.5MB
- SHA256 b253a1dd0eef41a206dd2cc6aa21511bc149f5554c102e27b20ffae7ef3d08c1
- MD5 fd46437eafc8dbb84bf3b8776da857e8
- SHA1 049a4d50d7de5d812e5b5c5367b056cdd0ad9303
- SHA512 d6b65e92d9537b44b00a3f5afe1b8d89c2aae47fb3543316ccba1bc219e754d8df222d8820b7f4dda5150ef197313bce84901cd11b362b96368442e64516388a
- SSDEEP 49152:yGUzMc8/yBNv6d2NW/TGR61uVYUyayqkmn4:yMKSGwTGU8V9yqy
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Enumerates processes with tasklist
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
- MD5 08e9796ca20c5fc5076e3ac05fb5709a
- SHA1 07971d52dcbaa1054060073571ced046347177f7
- SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
- SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $TEMP/Colleague.pptm
- Size 117KB
- SHA256 af94d44663cb9a2ddde2f82eb49ed430ea93db0fa11ad1c907b5f010678406b6
- MD5 a64513be4758c6ad8a68ca2aa6a9c335
- SHA1 7cb7066a3c78e4bf28ddabef0b70d7bdbdfab5e2
- SHA512 dece5b78e242bbfb35d244dc76f35eac5fc2873c812486bc12d0b24fb0c575f25e57c723a67f7865b4b6cd0dc775e8e01bdf8e540f6251fd573bd3d878d15581
- SSDEEP 3072:+vKahiULcUcBeACORW6z6Budf9APwFXV3x0Utrm:sfiOwBeoB6kdfdFXV3aUVm
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  $TEMP/Combination.pptm
- Size 246KB
- SHA256 e863c0bb7dbcf55b523ce30a30e68a9987bd26b2c5c2c7914bcb6f0cefb96a37
- MD5 be34a94cda5ea0965abf3ad38f188c69
- SHA1 111659749e62796ac30b12b4651586f6a9665d60
- SHA512 464fe1c08f0a03d04ca7e705e9c22a3e244e2fcb78931cf578b6a72254788111172da4fc8f49df0e7dc7081b675e23fb33a99f0cf460f8ca5acc2fb3baf8f7c4
- SSDEEP 6144:0r0k4kvqeMqnsczAkQloGS8Cs7E98qB/kh87aeDDUQ0:mceXsczAFS8OB/Ff0
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  $TEMP/Mg.pptm
- Size 220KB
- SHA256 c4263669d4fc3a361263cb0669b30d69cac5b1ef6f5c86275c6995906c0cc20a
- MD5 de2acd6ab77ac50c93eb296087d1c19f
- SHA1 2abce286d3c7cfba73fbc6814c589e39e4254449
- SHA512 3048de2e2fc4340f228ef61ad70229dc1a82b6f5df9ebe73ba54b0c9c26d70efb3f68ed0c0ec2798cb3b824884d7e780a31ecfd5ece6e7b112f6ed2154cb415a
- SSDEEP 6144:NpBFSVeMlfYBXFLJ/nW05FY0UeKkxWgbd36ADZNwNL/fNOYsZZc:vofYBX5J/WaFVLLj36ADZuL/fNOYsZy
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  $TEMP/Studied.pptm
- Size 23KB
- SHA256 84e4b210d3914449865821ee672d6f977d278c369c8ae0e4bf2d8e4a06c525ad
- MD5 12e898b857e2fce07c68a30435765275
- SHA1 a29ea74d0243df76faf6fe68251a2757fb494ac6
- SHA512 3242e824d3e53c2222ebc403c2038d054213982762a6387ad0ad332a53bbc99c80ee346d54ed2143f21c3bc2d476a9fc82a0e36fb751b18cc4e48ba153aaae21
- SSDEEP 384:H6wYzglQ8IZSOW0WUalaRkevvIU+oG4wynVDTkyl/7pEDeI2Sp1X2AKiau/5+Cv4:H6wYzglQ5FW01ac+OvtJNVDTkyl/ls3g
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  $TEMP/Tracker.pptm
- Size 288KB
- SHA256 eb8620aebffa73f22d14623f0ffdc408a5cb07c93461d40be08264c5321e184c
- MD5 bf15274b0c55d347bb38e4f21364e875
- SHA1 7b7eabe3db31ed40853bc26dcd84e0669b72ddcf
- SHA512 23be98e69c1a4ff77b212ebd52d30fb3dc2030546eda396876e94268d8f35e359099129ba3a2bf1d9275b2b3a70cb45a0d2c7298717abf1b3093e49eeee04a6c
- SSDEEP 6144:yL+R7eCgjhlDp/6IMRvCFW9etrsZphz1llc0Za9U0n/XJzNJ5fXmsN7y:gtXDAHCFWLvfc010nJ5PrN7y
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  $TEMP/Wa.pptm
- Size 43KB
- SHA256 a3b7fcaef92d866a4317321951d532e92177720288fc5cb8949a819692f0c99a
- MD5 1f4bc8204f40b5e9535e5dbf0a4ae501
- SHA1 f23659d2313c49ac57acd5fb9b54e66b1c45b3e5
- SHA512 0d493e31c75ccd9bc1aa82e25717bd9e4ba99e06c5b3bc430ee370f09bd691ca9be535e95a63504546b7fb6b4d0a5ab708de397c8efe3b78533920383fabca14
- SSDEEP 768:jmYtGGtJ/9DutQJVbRkj/lDPR/AG5M2ALcSB1IP0j5/xMTQlOB1Tz18:dR9tu+JRRQlDPRtMfLc+F/xMMOBpu
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Enumerates processes with tasklist

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16