463c23996374fc511d8707fb369530ee027b3aab84efcd107898db197c38439e

Sharing

Copy URL Twitter E-mail

General

Target
Kid-Pix-Deluxe-4_Win_EN.zip
Size 476.8MB
Sample260415-ythb1abz7v
SHA256 463c23996374fc511d8707fb369530ee027b3aab84efcd107898db197c38439e
MD5 8d5dc0fd9553b106c5e54faaf6786b1a
SHA1 b3718f3e36a2864c6e0954e4b5ecc2a3a673eddc
SHA512 30dee4e8885e0f8547f4fbc57f54804ba57949f079a5e82f4b844bf954b6a7c5f8cdf95ae0223680f5b62ff65e9b4e9e22e42c25934d75c8c8e82817f916bb2d
SSDEEP 12582912:ZbC0QLpQjW7Gowlw2bas1wVleLdH5ls2Invw6yEEQ:ZbC/GS7Go4zbZ1MkB4yi
TLSH
T13139332FDA66E459F87FA0B07CD7173A8894546B8407D51BB38433AC8E4BD5132A2C9F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Kid Pix 4/Data/Players/SwFlsh32.exe
- Size 144KB
- SHA256 f81e453f86a90d7f2528946d9fb9409f82c46cac5b3fb687d43edcff52b3ed0b
- MD5 62b49f75ac78ddf6e76786cad3e21005
- SHA1 b209971699c631e67ad57fbeb7da30effa9c9ba2
- SHA512 7ec42327f422ad3fd31b48c2468b8e7b6d2f7d561e15a2d4bea946df386c444ad27f5259ae953c5274185010a1a7695c52c09da8512d5f284973b1b463e221c3
- SSDEEP 3072:+rwugfGLbjXtDMv6XoOBbZa+L3WqX9qxawBKzuwvW8z1e0I:MbJ4vuHa+LLqM
- TLSH
  T114E38D3271A04079E0B343719D5BAFA43B797F2247349ADB5B903D2A2F31946DD223A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  Kid Pix 4/Ereg/Connect.htm
- Size 1KB
- SHA256 121e8c2ce12c7bce3121c22c4646813c690e52d57f057611f7a1d27efa076418
- MD5 359d986f40df246d9fe6c0de32c95971
- SHA1 e15432e09f8ee019313bd16de6f077d9866501f2
- SHA512 916e6906c7e7d11a07d7a26a96b5a4d27b7ca7dfe8dca4583ea59dbcc41e5b45d9a425c1a7ace2aa52afa012c60b639a5a02127bbf5b35c7015a8cd03ae6a94a
- TLSH
  T17531FE98BE8CDEED8143852391B1DD5899EFCC319738944670AF783711916A88AA3DF0
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral3 behavioral4
- Target
  Kid Pix 4/Ereg/EReg32.exe
- Size 272KB
- SHA256 302c033b1e186e4dcc921b05ee59bf46c57221f62329e6aa7c78848c0230bf97
- MD5 23dea713efefbe0d3e1a827430b86c39
- SHA1 be1546b9d6254f876e3ec324635d845bd763c476
- SHA512 817ba606518ceddd8a855956dbd7c0b3f26c5dc99ea680974ad64a26fb32647812a51bf16f59b46fcb700b71d506500075749bb8dd2faccda5964cb093e228ea
- SSDEEP 6144:g964RmMtP3oHpDx6mE3gorVmT8bVPsSFAo3s2:gMemM93wn6m6FV7sSFk2
- TLSH
  T106447D1273E2C872C6A711724DE69BA9B2B6FE614BB3578733C53B0D9E306D29039351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  Kid Pix 4/Ereg/EregMain.dll
- Size 160KB
- SHA256 9fb8a5d7f8f228f1c2093575aa0c9af593e56cf3ed5bf3ecf2c92dfd9591c241
- MD5 f68df23516f6d020918a6bef9c4bb569
- SHA1 c7ca39dfd01a9abe8a43ab288990f7dee6423d07
- SHA512 194c49f2ab75661787109811f6b08cc5720350146d3f44a5180d823b3bd868006602817241ba19059f69cdea1f8057d30fb4088f06bca5db46138a12db4434ef
- SSDEEP 3072:qfyP/VYhlppGBFbtjioXCuJ7k/dCH9g2yixLlayGNgIDGvaS0:qUgnaFbtuvu+lAz4yz
- TLSH
  T129F36B0272D5C072D1FA227D0962971563BBFC60CFB68A872B40375DAE70AC29D39763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Kid Pix 4/Ereg/ThankYou12.htm
- Size 1KB
- SHA256 953feb8342bed48a537243040c171c375e9cd5be27a42c9a01c30ca5ad977fe4
- MD5 bd3f3afc60472f4ae8f2da7eca1485a8
- SHA1 9be060ec0779317b306a53b07fded613a9f0f311
- SHA512 d366c29ca1acf432b366265158f4401153182027714f4f1c61f27433dda933a0c83f68c0ff4d7c8f660edacf43a22eff3c0ceb0a42bd18f106f7fe0af6b923fa
- TLSH
  T1A131CAD8FE8DDCEC864286B395B9DA94849FCD318338A489307F743B11919A447B2CF5
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral10 behavioral9
- Target
  Kid Pix 4/Ereg/WebReg.dll
- Size 380KB
- SHA256 d1fb4dfc90e5d496024b9b96f378c6f3779e439210a58516cfe794a93e7303a2
- MD5 9d4dae8e74c3043f012bb0f38cc66191
- SHA1 528ee9778b4506f8635f3e664647a58d2da796eb
- SHA512 605aac211d4dd557aa6dd44b563458a6189b148c42605628312c85d19ed2d455bdf60a73bf3ead4d154c5d0a473965572fab3749ac2b84a28ebe65e655dd39ae
- SSDEEP 6144:m579uhLaVQAK+yKhKKsrUWh09sfJAYF8p7tqhw7Dv1s2+H:Q79uh+V5K+Bh9sQelfj0tqhw7C2O
- TLSH
  T1FD848D42B6E380B5C69D017525235B5662FDBE504BF3D6D3B380BB0DAE326C2B939312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  Kid Pix 4/Ereg/include.js
- Size 950B
- SHA256 f2f9a72621a24f346a68dffa7145c1f6d525a90e40ad9f47e3fc7b8093c7ab46
- MD5 92c05a1bd26e676a710cd727bcae68d7
- SHA1 82a2d3030889470f15600df4e12447488bb90cb2
- SHA512 189eb65a9db7684ab2b1d9efc7e0a7ac2f1d2b919f7a572d6acddb2c56c6282000279b1cd79c52d98f27e657206b5afec9e98ecd71fbbeb3834e646db71f46f5
- TLSH
  T1CE11389BA007D41AB34A292463FB6ACDF89C24725E1DDC25B180CAC974F203AE1735D9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  Kid Pix 4/Kid Pix 4 User Guide.pdf
- Size 3.9MB
- SHA256 d44da40bb6a1c87d8c3cee1183f7dc1a1f0faa48fd3a4cda501d6acb64a2a55a
- MD5 f8dc55d41977655a3b37800cc1a2f287
- SHA1 7d93e09c6682dc0489d0e85160bbf65d6f08f023
- SHA512 6920b191053db501221f57bdc845620549a2abe4075c6a326c264b5dfad831dab28c1e15805fc8a225d70391c9c667da75f402684e16f42093b68675a51fc430
- SSDEEP 49152:psHSCrqSvooxNxWjuAR9ApAwr3dnottHSV1OwmAeZtFfjEOlIfd5Kj8tmjEosHS4:qBqqooxPWi9Bi2V1OwreJwOc5Kj8tmIf
- TLSH
  T1B71601245E284FA85CDE2A036700CC7483396FE1568B67A3BE3C2F8C77D8E94556617B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  Kid Pix 4/Systems/AutoDetect.exe
- Size 114KB
- SHA256 c500187ab0bafe03622c8fc4754915ed4cd36f643e691baf21c172c233660cc8
- MD5 cafb55aa463c6df8802122838d50d2bb
- SHA1 90054dfba153d69c426723121f2746d2aa18f912
- SHA512 e0d064db008543bf0d62ef93e60529393e7e7f1ff121f6e0cb7274a0ec981a3edeeb25cfb0a6564558aa8f6ed2750af39714cea3fd0bf3a5059f165b7a6813cf
- SSDEEP 3072:QAsBJ4EIukM38TrcAXJGnuMcwyBtJLt5Aa:zi4EIQ8ETucyVAa
- TLSH
  T1B2B33A1277E1807AF2F31731BD7526B14ABBBD311A38C60F5764264D1FB2AA5CA64323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral17 behavioral18
- Target
  DotNetInstaller.exe
- Size 5KB
- SHA256 4f9c15127e16eae3a7ddaed55817fb549ed31168f9861285c9349c468b260579
- MD5 f89558047e71f655a4ddb99e893213ed
- SHA1 68a0cd5af1aa62c46e965e8e5c85c33de4d4678a
- SHA512 6ca5e7ba0db836f88685868d0788119fd441f47972907727f4eb711955f63cc74e3e818b93069a1c2baa5c49e387978acbe8ecfbbbc1723a7f40f4c0e41dac45
- SSDEEP 48:67ndi0X7JBqVKk5YCfpZBAv8GPTUc4gQ+fzK/4hotiufsV5ZYNunoIwo8iwegMqu:4di0X7J0VJyopUwUQ+u/4FqsZYfNBsC
- TLSH
  T15AC17545E7E88336FDB78F3EBD7337824675BB108DA2976F05CE010A6C256608961B22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  IKernel.dll
- Size 712KB
- SHA256 cb29c9091d22a94e1aa72a6f2a83e01013e5148d8dcfba8c90d2cdbd6d9b6e48
- MD5 1ea0c41b4f2f0e807700f9a72d99ac05
- SHA1 65c693fd17be74d1c8dfeadd591f3c3408ae321c
- SHA512 3f4e80bd8d3808fb76acef835c70cc00503acf38f13d3cec54bbf9cf87343a4c1d148a146fa432ca884eaf3c327e199c17432c91f6d6424fb3c17890255feda3
- SSDEEP 12288:7iG5h/LslnIaEd+NFwwPlpFlkjjFV43j9qPA+6KaT+NBblHcIfzFptT:7iG5lwlIFUwwtpFlkjjFV43j9qVD++Nj
- TLSH
  T1CCF47E1335F8C125F28E0132EA2C9BB8A2F9DB654D3059473B488A5D6F75AC6C127F1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  IScript.dll
- Size 260KB
- SHA256 a1c284e21ca49ef189e98e7847826556e64185c5542bd50c75ee30b25ea3d08a
- MD5 84cfe010fd3403ad28835bb500a1a81b
- SHA1 c57afea136a09266eae1af92bbd53d7c0b084ea0
- SHA512 fce50dea91d5e34b6ede4a6dfa4978648062b0eb6fc167f12925002521674d513e978552b46ff3e693ae819bf695367d2fda70d5ee8e6fc7f44d205893e31ccb
- SSDEEP 6144:TvOq2nKzn8ppgfI1ueM6Htmr3CTtJLON1:TvOq2KzCpgfI+nrUI
- TLSH
  T1AB447D1239B8C575C7DE0B31FA9A3F68A6FDE2248DF288430F594E1CDE37A45851252E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  IUser.dll
- Size 188KB
- SHA256 c25957200e1390b6a5facb4b1c52c55a8690bd3ca63dbb2f2cc770510e74448e
- MD5 b54e00b79373514e838220436bd3f275
- SHA1 9cea61a706a28439574d8f1aafe40cd040f5e156
- SHA512 8efba669069d41c16e059cdf9bc74944e858b40e07f82a8160a3522e95ad770ab620bee78e0b10a184f31744931aeb790f4dcd4b895617875537ebd29b40a848
- SSDEEP 3072:rR5V8qXjwUr2evAytiDQ6Vfo/x67VSKxE3hzHwJO4co5Ht/H157:95j8UrTtIuxmbxUrNYD/b
- TLSH
  T17214AE127AE0C47BD29B0132BF6B1F69B7FDD2448FF459878B100E9E9EB1946C422617
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  ctor.dll
- Size 68KB
- SHA256 9620bdd78c1cad92a2118eab21e4dfa0ec8e9b59673adb84f917331b78402ad0
- MD5 66cf4f30f925485e00191c16d00038c4
- SHA1 80b576f6e5eebd5577cde81cbd6394136b9f08e6
- SHA512 18072bdf7ab50132a08d620b5571c4c8ecb245124d91ebfda5cba1aac4fc41e020ae037cd7a49cfd119978b91c628428e85d2e7bf7ef362d319d9451e6c62cf3
- SSDEEP 768:6mb6ReJQ+khADnEq+nZ15J8+DxhOHGyXClJS1NVCGJBVVgyw0oTH0w9nnbH67HIa:6q6ReJQlA5o0AhX7YnnwPJr67n
- TLSH
  T145633B1B23E3C5F1D7972332BB592B5E217E6E1531E1A3168F1349E32C3262BD662907
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  objectps.dll
- Size 32KB
- SHA256 b2278ce559b4d4cdce30c6b44f3664d1a6d1a5f0d9e1d99b87ba14bdcf31f4c5
- MD5 f935e7f618e9fab282302c0951545417
- SHA1 e04ea46a0445d78580839102164602a24e581464
- SHA512 4f0f11b35415ad8879bd182de17dfdc43045133bc11107254cffb8478508ec21a5400c707d66186e042bfef865ddd628d5526b0d32e4e08d7ef8ceabf9d49218
- SSDEEP 192:JnlX6cRWMxG4RMG180GoxMOSkA7sMC7znkDAa:B3B5Mcz6sMqgN
- TLSH
  T1E7E26412EAB659B1F68A40343C761577662D3C3148E9E073ABC2DD4E287D2F3856EB03
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  DotNetInstaller.exe
- Size 5KB
- SHA256 bebd6c76779cd445865ae3128cdd563af85db780f253a63c71d84af73781cae8
- MD5 9b4533452349cb8f2f111682c8d640a7
- SHA1 1aa024c9992ee4a9da485df63736e210c30d7548
- SHA512 7b8c3ff708e56da44e20b266fdbaddadf129588b272e2f9ed7069d6ccb4e89e2ecd7bbd6b19f2f9a1e531e21b00f1e6a40b1a9dc61a78b368fd39bb981c1ed08
- SSDEEP 96:qdi0X7J0VJyopPwUQ+u/4FUZYBmUsC/T:8X7JQ42wuuQyKV
- TLSH
  T165C18445D7E88336FDB78F3EBD7336824675FB108DA6E76F058E010A68255608971F22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Checks installed software on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32