ed6ad1a77e7063c06ca21fc77d522ea93dd9eba34f63ffd71d5736abf200dc18

Sharing

Copy URL Twitter E-mail

General

Target
TSS.zip
Size 36.1MB
Sample260409-amfb3afx9n
SHA256 ed6ad1a77e7063c06ca21fc77d522ea93dd9eba34f63ffd71d5736abf200dc18
MD5 71a59b6cb0c09da44f970b3b07430186
SHA1 787a86b2920a84599bd036d64ff33e4149d4cadd
SHA512 3f76c7e47fa74cbfcc272583cc595c53474e23538efd0fc5c11a5765be13d7c27a0ff53d95810bbecc8dcfa1e628cce04ad23d4006fd495b2320419f5f69e7c6
SSDEEP 786432:wggz27IFkIihHxlCFY7eIji5wNzjmbQQcdcdj+iTdqOI+smF/ltA:wg/7HFlUYK4zjQcdmj+A+mF/ltA
TLSH
T1BB873318C2E93B35D1BBA9FD629A4B60F1F365D328BD710F022D2550B99B3E90613793
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
http://bemis.partners.extranet.microsoft.com/2718662

Extracted

Language

Source

URLs

exe.dropper
http://bemis.partners.extranet.microsoft.com/2628581

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://vkbexternal.partners.extranet.microsoft.com/VKBWebService/ViewContent.aspx?scid=KB;EN-US;2176002

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://support.microsoft.com/kb/312362

Extracted

Language

Source

URLs

exe.dropper
http://support.microsoft.com/kb/892100%20

Extracted

Language

Source

URLs

exe.dropper
http://go.microsoft.com/fwlink/?LinkId=211872
exe.dropper
http://go.microsoft.com/fwlink/?LinkId=211875
exe.dropper
http://go.microsoft.com/fwlink/?LinkId=229679
exe.dropper
http://go.microsoft.com/fwlink/?LinkId=229691
exe.dropper
http://support.microsoft.com/kb/2200187
exe.dropper
http://support.microsoft.com/kb/2025726
exe.dropper
http://go.microsoft.com/fwlink/?LinkId=229714
exe.dropper
http://go.microsoft.com/fwlink/?LinkId=229715
exe.dropper
http://go.microsoft.com/fwlink/?LinkId=229719
exe.dropper
http://go.microsoft.com/fwlink/?LinkId=229720
exe.dropper
http://go.microsoft.com/fwlink/?LinkId=229721
exe.dropper
http://go.microsoft.com/fwlink/?LinkId=229725
exe.dropper
http://support.microsoft.com/kb/2645996
exe.dropper
http://support.microsoft.com/kb/2694215
exe.dropper
http://support.microsoft.com/kb/2023007
exe.dropper
http://support.microsoft.com/kb/2703028
exe.dropper
http://support.microsoft.com/kb/2703708
exe.dropper
http://support.microsoft.com/kb/2693500
exe.dropper
http://support.microsoft.com/kb/2680976
exe.dropper
http://support.microsoft.com/kb/2015644
exe.dropper
http://support.microsoft.com/kb/2758780
exe.dropper
http://go.microsoft.com/fwlink/?LinkId=211874

Extracted

Language

Source

URLs

exe.dropper
http://support.microsoft.com/kb/2618669

Extracted

Language

Source

URLs

exe.dropper
https://vkbexternal.partners.extranet.microsoft.com/VKBWebService/ViewContent.aspx?scid=B;EN-US;2694134

Extracted

Language

Source

URLs

exe.dropper
http://bemis.partners.extranet.microsoft.com/2693877

Extracted

Language

Source

URLs

exe.dropper
http://support.microsoft.com/kb/2182466

Extracted

Language

Source

URLs

exe.dropper
https://community.dynamics.com/product/crm/crmtechnical/b/crmteamblog/archive/2012/03/02/improved-upgrade-performance-in-ur6.aspx

Extracted

Language

Source

URLs

exe.dropper
http://support.microsoft.com/kb/2475761

Extracted

Language

Source

URLs

exe.dropper
https://vkbexternal.partners.extranet.microsoft.com/VKBWebService/ViewContent.aspx?scid=KB;EN-US;2213917

Extracted

Language

Source

URLs

exe.dropper
https://vkbexternal.partners.extranet.microsoft.com/VKBWebService/ViewContent.aspx?scid=B;2687234

Extracted

Language

Source

URLs

exe.dropper
http://blogs.technet.com/b/askcore/archive/2011/08/11/windows-2003-server-cluster-and-access-denied-errors.aspx

Extracted

Language

Source

URLs

exe.dropper
https://vkbexternal.partners.extranet.microsoft.com/VKBWebService/ViewContent.aspx?scid=B;en-US;2011797

Extracted

Language

Source

URLs

exe.dropper
https://vkbexternal.partners.extranet.microsoft.com/VKBWebService/ViewContent.aspx?scid=B;EN-US;2566165

Extracted

Language

Source

URLs

exe.dropper
http://support.microsoft.com/kb/825036

Extracted

Language

Source

URLs

exe.dropper
https://sharepoint.partners.extranet.microsoft.com/sites/Onestop/CTSSQL/Pages/sql%20corruption%20dell%20machines%20scribble%20pattern%207f87312b.aspx

Extracted

Language

Source

URLs

exe.dropper
http://support.microsoft.com/kb/931125

Extracted

Language

Source

URLs

exe.dropper
http://blogs.technet.com/b/pki/archive/2012/06/12/rsa-keys-under-1024-bits-are-blocked.aspx

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://blogs.technet.com/b/askds/archive/2010/03/31/tuning-replication-performance-in-dfsr-especially-on-win2008-r2.aspx

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://support.microsoft.com/kb/942843

Extracted

Language

Source

URLs

exe.dropper
http://support.microsoft.com/kb/315407

Extracted

Language

Source

URLs

exe.dropper
http://support.microsoft.com/kb/2974384
exe.dropper
http://support.microsoft.com/kb/2967755

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://blogs.technet.com/b/netro/archive/2010/11/24/arguments-against-disabling-ipv6.aspx

Extracted

Language

Source

URLs

exe.dropper
http://technet.microsoft.com/en-us/library/cc755994(v=WS.10).aspx#w2k3tr_repto_how_imft

Extracted

Language

Source

URLs

exe.dropper
http://blogs.technet.com/b/askperf/archive/2012/03/06/performance-issues-due-to-inactive-terminal-server-ports.aspx

Extracted

Language

Source

URLs

exe.dropper
http://support.microsoft.com/kb/975363

Extracted

Language

Source

URLs

exe.dropper
http://support.microsoft.com/kb/327825

Extracted

Language

Source

URLs

exe.dropper
http://technet.microsoft.com/en-us/library/aa996786(EXCHG.80).aspx

Extracted

Language

Source

URLs

exe.dropper
https://vkbexternal.partners.extranet.microsoft.com/VKBWebService/ViewContent.aspx?scid=KB;EN-US;2635684

Extracted

Language

Source

URLs

exe.dropper
http://support.microsoft.com/kb/958644

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://vkbexternal.partners.extranet.microsoft.com/VKBWebService/ViewContent.aspx?scid=KB;EN-US;2218209

Extracted

Language

Source

URLs

exe.dropper
http://blogs.technet.com/askds/archive/2008/10/29/port-exhaustion-and-you-or-why-the-netstat-tool-is-your-friend.aspx

Extracted

Language

Source

URLs

exe.dropper
http://support.microsoft.com/kb/2697865
exe.dropper
https://vkbexternal.partners.extranet.microsoft.com/VKBWebService/ViewContent.aspx?scid=B;en-US;2716108

Extracted

Language

Source

URLs

exe.dropper
http://support.microsoft.com/kb/906952

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://support.microsoft.com/kb/KB947477

Extracted

Language

Source

URLs

exe.dropper
https://vkbexternal.partners.extranet.microsoft.com/VKBWebService/ViewContent.aspx?scid=B;en-US;2670246

Extracted

Language

Source

URLs

exe.dropper
https://vkbexternal.partners.extranet.microsoft.com/VKBWebService/ViewContent.aspx?scid=KB;EN-US;2232459

Extracted

Language

Source

URLs

exe.dropper
https://vkbexternal.partners.extranet.microsoft.com/VKBWebService/ViewContent.aspx?scid=B;en-US;2003705

Extracted

Language

Source

URLs

exe.dropper
http://bemis.partners.extranet.microsoft.com/8/Pages/2714828_en-US.aspx

Extracted

Language

Source

URLs

exe.dropper
http://blogs.technet.com/b/markrussinovich/archive/2009/09/29/3283844.aspx
exe.dropper
http://blogs.technet.com/b/askperf/archive/2008/04/11/an-introduction-to-pool-tags.aspx
exe.dropper
http://blogs.technet.com/b/askperf/archive/2008/05/16/troubleshooting-server-hangs-part-four.aspx

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://blogs.msdn.com/b/distributedservices/archive/2008/11/12/troubleshooting-msdtc-issues-with-the-dtcping-tool.aspx
exe.dropper
https://vkbexternal.partners.extranet.microsoft.com/VKBWebService/ViewContent.aspx?scid=B;EN-US;2506972

Extracted

Language

Source

URLs

exe.dropper
https://vkbexternal.partners.extranet.microsoft.com/VKBWebService/ViewContent.aspx?scid=MSS;EN-US;113012110154455

Extracted

Language

Source

URLs

exe.dropper
http://support.microsoft.com/kb/2512845%20

Extracted

Language

Source

URLs

exe.dropper
https://vkbexternal.partners.extranet.microsoft.com/VKBWebService/ViewContent.aspx?scid=B;EN-US;2600881

Extracted

Language

Source

URLs

exe.dropper
http://support.microsoft.com/kb/2459530
exe.dropper
https://vkbexternal.partners.extranet.microsoft.com/VKBWebService/ViewContent.aspx?scid=B;EN-US;2675132

Extracted

Language

Source

URLs

exe.dropper
https://vkbexternal.partners.extranet.microsoft.com/VKBWebService/ViewContent.aspx?scid=B;EN-US;2584922

Extracted

Language

Source

URLs

exe.dropper
https://vkbexternal.partners.extranet.microsoft.com/VKBWebService/ViewContent.aspx?scid=KB;EN-US;2691464

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://support.microsoft.com/kb/2509997

Extracted

Language

Source

URLs

exe.dropper
http://support.microsoft.com/kb/2509997

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://support.microsoft.com/kb/2973536/EN-US

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://www.microsoft.com/en-us/download/details.aspx?id=38826
exe.dropper
https://vkbexternal.partners.extranet.microsoft.com/VKBWebService/ViewContent.aspx?scid=B;EN-US;2961421

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://www.microsoft.com/surface/en-us/support/install-update-activate/pro-3-update-history

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://vkbexternal.partners.extranet.microsoft.com/VKBWebService/ViewContent.aspx?scid=KB;EN-US;2998588

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://support.microsoft.com/kb/2973536/EN-US

Extracted

Language

Source

URLs

exe.dropper
http://www.microsoft.com/en-us/download/details.aspx?id=38826
exe.dropper
https://vkbexternal.partners.extranet.microsoft.com/VKBWebService/ViewContent.aspx?scid=B;EN-US;2961421

Extracted

Language

Source

URLs

exe.dropper
http://www.microsoft.com/surface/en-us/support/install-update-activate/pro-3-update-history

Extracted

Language

Source

URLs

exe.dropper
http://support.microsoft.com/kb/2671722

Extracted

Language

Source

URLs

exe.dropper
http://support.microsoft.com/kb/875495

Extracted

Language

Source

URLs

exe.dropper
http://support.microsoft.com/kb/2575088

Extracted

Language

Source

URLs

exe.dropper
http://blogs.msdn.com/b/crm/archive/2012/09/19/enabling-kerberos-for-microsoft-dynamics-crm-2011.aspx
exe.dropper
http://support.microsoft.com/kb/2536453

Extracted

Language

Source

URLs

exe.dropper
https://vkbexternal.partners.extranet.microsoft.com/VKBWebService/ViewContent.aspx?scid=B;EN-US;2564154

Extracted

Language

Source

URLs

exe.dropper
http://support.microsoft.com/kb/884776

Extracted

Language

Source

URLs

exe.dropper
http://support.microsoft.com/kb/2647753

Extracted

Language

Source

URLs

exe.dropper
https://vkbexternal.partners.extranet.microsoft.com/VKBWebService/ViewContent.aspx?scid=B;EN-US;2721389

Extracted

Language

Source

URLs

exe.dropper
https://vkbexternal.partners.extranet.microsoft.com/VKBWebService/ViewContent.aspx?scid=B;EN-US;2651106

Extracted

Language

Source

URLs

exe.dropper
http://support.microsoft.com/kb/936655

Extracted

Language

Source

URLs

exe.dropper
https://learn.microsoft.com/en-us/azure/virtual-desktop/whats-new-agent#latest-available-versions

Extracted

Language

Source

URLs

exe.dropper
https://www.myserver.com

Targets

- Target
  BIN/AgentConfigManagerLib.dll
- Size 18KB
- SHA256 3eb912e99216eafc4c8ce970c3f8575b1f211dfc1774f9504667523e1be2b102
- MD5 ed888e53c1b092364332169683b05c31
- SHA1 76f4246a47e9d7f884c08220b76fdfedd8da24b6
- SHA512 09f490ee28b594f42731ad38be0647002b3e75b410145419db10cd8e744113a007acb787d4fcfebf083efead4f7c9f378de1e1af2cd45ac85aef098bc14b7dc6
- SSDEEP 384:0ED4fVzE5anfLWpuWQ7Wr2VHRN7EUiu0R9zIUa7X:0W+FE5iWpuhWOEXu49zbMX
- TLSH
  T157824AE3F75CB546DCEB1B706296CAB32D3887C712508A1B461CFA5A0D537899F2123E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  BIN/ConnectivityDiagnosis.exe
- Size 120KB
- SHA256 a8f58da0f5885c733c4ca78ba3b4001ae7a41a63a16a0ecb121b68c4be7c717b
- MD5 eb7d7cfe3e5b47403a98e949485e1156
- SHA1 24c15060244181f4e9a6d27e1d4faaa94d306555
- SHA512 144b04209c0abcd7c98671da630dd0ed8cd3b051c4816361951d1bbe8705bf88cd90a75c08d7dcdc354ff05d1797fa1d615bd4861b61819d02d8924cffd6ddd0
- SSDEEP 3072:7uU/cFpmJGfC1/51PgWmkxJcyPzCQ/78bLj4SqcYxPC:h3TPBcyPh4LHqR6
- TLSH
  T14CC35C4217FC4A2EF2FE8738E172411147B1F8473526E75E9E84989E1E63F809A217B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  BIN/Coreinfo.exe
- Size 1.0MB
- SHA256 bf9194b869bc7e3d16d088ee038a78dfa95bd92222d3f684d672fcf6795632e2
- MD5 3700ee57b61a55d1a7840ba1434f9b83
- SHA1 79476c66918d70acf27989f7a8502f48ae2eee15
- SHA512 5b5eab04b92e8d6f0b80930648be6581af5bb2c05f11c55c59b5e34195a868ceafc27f29f068e8c1a838e6db69dffcf9b65b2da67f54022e5cef66128c1ddf0e
- SSDEEP 6144:mN2H6QY/SnAI8nfWSeDI0squ9u5Puw1cFL20bl011985UJMnJ91LOqACJMb:mt/Sd8O7Pu7w1cA0bGbdaLHAyu
- TLSH
  T12A354A51B3E844A5F5B72A3059B496269A3ABC625F30CA9F1394416E4E33FC0DE35B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  BIN/DatabaseAnalyzer.exe
- Size 533KB
- SHA256 6aec6fbc98a9419924055703a209c77b685ddad7676c406cd4474d23f292817f
- MD5 ac67791a1bf751e2896243ad5f87667a
- SHA1 3226e849139c341272f5375d276378c80e3e2ba1
- SHA512 4d7f6e0b52051c4aca95cd7151349f41ee4f4e214f1e66794adb8ff5512123c0c56fb3e060077bbc84fa709fad7c425d8c609a8a9e60af903632e96891f849a6
- SSDEEP 6144:QKhXnJ3SKzabjpnf28wmKzZhKEc5QH9kI6EC5JUl0rQVbRFiWGYxVthVRspQ8X:QKhXnJ3SKz0NOOQOWJthVRgQ8X
- TLSH
  T126C45441A7EA5304F1FB2F64E9B65166483ABF52AC3DC25D1419258E0A32B08CD7BF37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  BIN/DisplayExtendedAttribute.exe
- Size 306KB
- SHA256 19e9e4577157d0c7c04527757842369dac21ab3c1d1a5bda7d78998b17a545c3
- MD5 4e745ce8ec7a033d377d895de20bda8a
- SHA1 24070834b4000495b551fd679832760486009865
- SHA512 fb4234b574d3c847d830dfd1e5160c4c0a30141cae00276cb7f79d055928aa6d7fca855d932598eef14b4d63087b84b15a8dfaec69265607cbb9d701d989f076
- SSDEEP 6144:huglBLReR8KpYrFwZErWJ4XsNVUcoJfW98TBhqWOs3X:WYQ8T2WB
- TLSH
  T1DA64754BBA6519E1C4BAD0399582722FF8B134A1477497C7A6829A1B0773FF8BC3D344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  BIN/MDEClientAnalyzer.exe
- Size 870KB
- SHA256 0ee5c392d4ac00bb2599607fb2321bf58be342b630ced04541c23f6cf3765aa1
- MD5 bf9f70e94b5e30f8ba35c6eb89481cad
- SHA1 ff0de38e1059d6666330567b659feec514e14371
- SHA512 9a04263afb331badd00e22f4a2f4bda7bbae5da12dfbc095f58e1c0e2a566314be39073b933c66871d15f73327522bc57e354d3dabe98b086ef5f72c575f75af
- SSDEEP 12288:Rqi9s4XzYMAnViI5hjz9u+H5l0MS7fNJOEFdP+u3fKdka3OOHF:E94EMAn4I5m+H5l0MSrjOIIkqOOH
- TLSH
  T186158F3278D880B6C9A321B5169CB279827FE4B00B7141CB17D867FEDE643C16E7169B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  BIN/MDEClientAnalyzerPreviousVersion.exe
- Size 21KB
- SHA256 948d0fb60f73686b363608b010b56620314a031b0434e041f5ec01fb03e5cb34
- MD5 e6c7fa16848af2a769bfbae68b074aab
- SHA1 a0d767c2b1b6a1ac414ed3a36d35531173a30939
- SHA512 6ee3d86fcd26fc6933c46e90fbde492b33532f1dbf02987aacf80f7ad5c6bb0e33e8b33335a748c7119fd1fcefb13c975f3a81ce3ff97c5ddd8bfe780ab40fa7
- SSDEEP 384:wa//ue+HAoaMjfq0wEnmhr2VHRN7hFDR9zjd7EP:waYUI7HmhODl9zlEP
- TLSH
  T1F5A22B51A6D8910AEBBF2E709BF1D5821F397BC31D31D91E19C5A18D1D6F7809E30329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  BIN/Procmon.exe
- Size 3.9MB
- SHA256 5f334916a5b224bc6af7137608d63fdebcdfcc888e7e39946161bb472fab33b2
- MD5 ce92949961476e09b71107d771834e19
- SHA1 769f8471c938e3ad75241b9d609aa4ad8f90bea2
- SHA512 9565ad420eb50b425c0e1b28e375a33e9c94c4e65f933698bbd1aaa87b749a011788aeef2fd8245b1603894def0d5349934e7718b8c444e2964a5174a00da8e2
- SSDEEP 49152:c9TJDVmHMAlNXFJelNOBLVKcu6NvhM6qHJfTJb5lmzSzko22LGywmtG6tlp0NjCX:Q4sA5JelIBs9JlmzSzko2zjCf9fJ
- TLSH
  T132167E1333D440E5E26952308ABBC67AD6767C79077245DB26E84E4F3F32AD52A38732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence
- Drops file in Drivers directory
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral13 behavioral14
- Target
  BIN/SQLCheck.exe
- Size 180KB
- SHA256 41c4ce0a9260637568a6c70f0cfa53861b2f2cd16be4d7b5fff8059fb09befad
- MD5 8721b36109958906007ab4c7f2ee50ce
- SHA1 54dff7a9f31bcad1136c702b2550c5cdb98e5a13
- SHA512 9a4367a073e7dba2dcd7f1274ff8e8764236d1063107fb8adae5fd67f1e455b6cb214768e42c06470dbbf5ed20865670a3f649d1671f801fa610ec11e976a6e9
- SSDEEP 3072:vufAQo+mji6CgZ7qqhn6BFiHZps3CfcBL7tZA/V/1s70PX5qYRpd:GfCueiilukqK
- TLSH
  T14104950437F81604F1FBAFBA59B598054777BC9B9A31DA0D1E8710890BB2B81CE65F36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery persistence privilege_escalation ransomware
- Enumerates processes with tasklist
  discovery
behavioral15 behavioral16
- Target
  BIN/Showpriv.exe
- Size 18KB
- SHA256 91d30d1a253ca3b359985b6045bc1a3cf4763a845251a5719784077f7bb5a814
- MD5 3a4f503228987f9879ef7f9ba7ffb694
- SHA1 e2228350b8c6f3347678535c6a76e15dca683a92
- SHA512 023999827f95c2fcf822009c1743a8ebfed6ea9d936dbd41cec367d026f8cc1906d340cbf2477b5061116b3b49c92f5bbf620e7a5cb767ed0d407509d2a2c4c8
- SSDEEP 384:WwE6ur3iEvPnYXsD/OOK3U2xJg6WJzWCCD/HRN7Ps4lGsqAxayS:YYEf6DvU5l
- TLSH
  T1438209D287FC051AF8E71AF05AB8D1172C3C7ED71F1182AF0566A15D39927E09A3832B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  BIN/Sysmon.exe
- Size 8.1MB
- SHA256 f2ab7b31ac90f434f997e180be17898508b715cb7b2aefde5123f24c7e7afcb5
- MD5 99f8a5a81c9a417e2c53844c9af2fc89
- SHA1 8866683967b92020b652c720b0be800f93155602
- SHA512 212e07467e381c2aa3377a555d3e2819ea47e07801d6928c691b3677820931171c180b9425bac5df41ab1a4f5824fe74804aa33af6be5f9ccd969be17eccd7f6
- SSDEEP 196608:BSfG77Vdd6GNXIXbD9cf3D8wYyNPEgFA6FGauQ9P:n7YCP9FA6saB9P
- TLSH
  T1F086630267FC0418F5F36B799B7A98518A3BBC660B34E5DF00581C5D0B73A829DB6B72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral19 behavioral20
- Target
  BIN/VmlTrace.exe
- Size 211KB
- SHA256 480998ee3a5fe83d779c602491e241b735fcd979441a49ba4b1a8e9295b88cc4
- MD5 b95cdf26e49fe20baa2a73d31863ece5
- SHA1 c941cff95d1f713a06b8e4b9300dd863db432077
- SHA512 a456bd0008ee3a5d66f8d89315199f52b8fbebc85b98843c191b83ae8624d4f8471d6bcf0ee7258efe2bd32308e237ec5b52c6eae1d0e79f48bfbaf631d1f723
- SSDEEP 3072:GRGh9b2Y85JA8th5IqyO9hsMdOembPN8OFTW5I1uWtOODESXZJiTpW1DxY2PLb:GRGijuO9hROeeN82dPsyDx/3
- TLSH
  T1D5244A5973E810FAF1B7923C89B18515EA7674510B308BDF136443AE8E37ED49D3AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  BIN/VmlTrace_2012.exe
- Size 64KB
- SHA256 373ba03d60cf7239741b2d42beffff02d9f75c99d671f58bfe62baf49b45ce50
- MD5 225f796e4b74186b8063e08457e2b8e7
- SHA1 58104b730d1186b9d3f41d562db5cca57970d901
- SHA512 fe010fa0ea045aac2a0e10d6b5aadbf8aadd7493e02d1ce57ffdf1e382d9040c03cbd392434a19749961c5a8fc9e3e36e51238a81862613b28f06594e63a2676
- SSDEEP 1536:TEOlfiYTaEJehc9L74ZXui5I0KFxQU5FPKeC4dezFW:TEOs3ZbI0KoU5FZIE
- TLSH
  T14153B3542BE810C6F1F7A6789AB58521AD77B8915B34C6CF2260938E0E72FD08D36727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  BIN/WinHTTPDiag.exe
- Size 181KB
- SHA256 fe28bb3894e170bd4766c47d2ddfb75e22cfc54482fb29801dfdad08fb5124ee
- MD5 f738d79ad24e64d4333b2633bbafcf9f
- SHA1 889f515db1e14b5d0f42d84b200539da1522450e
- SHA512 224a07c75785595bebbcad1c02aae4fb60dec7f06faf471752229fb9801b1368240c2a68d9320cdd04487e192cb733006b0bfbf7c21344516429fdd47955b120
- SSDEEP 3072:CtpJeTStP0J0VgB47NfinzXaN2IVb1pgupmIR:sNP0J0Ve47QzwjMi
- TLSH
  T196048C1773A022FAE5774234C9955602FB72B8720734AB5F07A056B95F233909E3EB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  BIN/accesschk.exe
- Size 1.4MB
- SHA256 aec4e27eeca1b0b1be80c0256e50e13eaad2a61e5e4f80401d94272f4bdd57dd
- MD5 30efba9ee6784a70926f92ba487029c7
- SHA1 ff44e79988b7c955006f04b6ffdcfea0b01b0390
- SHA512 f87e1c0fdc40f0aa087cb1e3e70e67b5b536db3475767a37f5c484e180be22d299139273044bd9b70d8a12e5195c7acebab0571cdfff4c8b51cb430fa60cbc95
- SSDEEP 24576:Pmn67EiHR38ZCRxVufXW6qGLl+GO+0WK+H5fti2u:u6V58ZCRyfX4aOHWl5fM
- TLSH
  T1FD658D0177E0407AE17775758EBAC661EA7AB8610B35978F1398067A0F237C09F3973A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26 behavioral27
- Target
  BIN/autorunsc.exe
- Size 701KB
- SHA256 666aa8972b4b0a1e5df53c076af44479f2f94b16f9fb56e15e6d104ed86ca9f4
- MD5 b76978d483ee6afcf5b919a51a7d111e
- SHA1 6b0292325505fc3ba638d42330a75cbdf237561b
- SHA512 2e7f076441f7cceb1e1eb38044d7a7df4226249d4526621bb23e28fefaca80820f5a5899709862191b03837aa659be076dfc960488e24a8dd5f87b28aefe804d
- SSDEEP 12288:WN/2Ekjc139fb/AJEAs8K85G3wwgwI6Ox1y95:WN/LX/AJ9s8/5G9gwI6gy7
- TLSH
  T1FEE45A0076A59035F1F252B029399776383EBC719A358CDFA3C0695E1DB5AC1AB3872F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28 behavioral29
- Target
  BIN/avdnettest.exe
- Size 3.1MB
- SHA256 69371603a8036afcd9ef7aeab6d9951ff0b259cc9c538a16c0737d9ca1cf28fe
- MD5 88a1c4519513c2e90754f1f96ade7dae
- SHA1 a940cd32f62e183903e038c288b63edf6f75f440
- SHA512 070bb4a558764a5a1d538646ffb1983a0d3cdda209ce2887566a343557340e34d8e1db24fa0a38687695a5f7c2f826e25a545684aac793985ce879259f6bca8a
- SSDEEP 24576:ZCot/mf3YJ2AhggR6BDquTibG+gG4Ij028r2X7Sp1qSdc5+h+WRMX8Jdfy5x:YohIIhN6BDNTlHIA28r2XE1qSBJWXp
- TLSH
  T175E54B69EF5C1286C1F7917D4A474B06D6B2F44703326BCB01A5A6F91F67BE04F3AA80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31
- Target
  BIN/diskspd.exe
- Size 482KB
- SHA256 05f1632277731b5ffc6d5715249436766cff1792de8cad0c46439e2531d9fe6d
- MD5 b8cb635dffa7680f9ea7f4d25e87fbb3
- SHA1 713f893625c49e0a1825a8086d3aec6fcd980ed1
- SHA512 5825b8fa97e677d41521cac7093d0d26f7592b24d5f18b69420a259df5396188fd37ec76b2333ac83682d951b9fb470e52f955d2f333fca303d1076152bafafa
- SSDEEP 12288:U7D+OKR3NedDNNNDn9hlERWfrORpkMux+ImA4lso:U7aOIN4HcWhvUA4ls
- TLSH
  T1DBA47D226B8885F4E267A035899B4647F3F1704713158ACB379DA6392F37AE05E3E770
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

Drops file in Drivers directory

Sets service image path in registry

Checks computer location settings

Enumerates processes with tasklist

MITRE ATT&CK Enterprise v16