abe6ee58809430c655532be827752747d190a3137c117249b62aacc22d1f3880

Sharing

Copy URL Twitter E-mail

General

Target
AVEVA PROII Simulation 2022 x64.7z
Size 646.9MB
Sample260506-bzsnlag16w
SHA256 abe6ee58809430c655532be827752747d190a3137c117249b62aacc22d1f3880
MD5 5574f69bd1f472135fb6ae8cb057c36d
SHA1 d550d2603ea6b926e9c91e358b4e1072fa3349d0
SHA512 570980b0ded0e7f3708c22c59ed3e7e95f44c48ad7abd5e28ff4a1599a894b152fcbc6bbd8c878e077027ee6b45666aaaa94a7c48db20bf73c9763448a2c9504
SSDEEP 12582912:gkadyEm96LHUmKv8sFYMEscqDJtvuh1s9+/tUufvD:nInLHUFBisccPaC9q7fb
TLSH
T14A6933A8986F17368059EA30F64229155849B97A145CCC94FF24EF34DFBB6C338F25CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  AVEVA PROII Simulation 2022 x64/Crack/PYG64.dll
- Size 1.2MB
- SHA256 2a58e9d0f41a5a043f146b079ab255d8954a8ecf0102de682cb1eceaa1424588
- MD5 e58a2e9c26b86954ce6e96a7f9e44989
- SHA1 d60cbbf0a288ee66b55508e7e374f705df38f9e5
- SHA512 6debeb92a97a238a8eed844d262b3027f3fd9fcd7fcfafc932e7ceff28e70fb1ad286764b37159b1a62fb5f645337e5bf32068fb926ce35512292919122e6b66
- SSDEEP 24576:6YPvPiECnLGEuDSOm6MUi/C1BUfUlxabtRRcG41kphEZ5GP48iv/fHoB8VD:6Y6iBSTaTlxGty18WD8awaD
- TLSH
  T15245226CACB52C52E32080FAF534E4607864C989E7A552DF1ECA3F94BF8B9F25D75081
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  AVEVA PROII Simulation 2022 x64/Crack/version.dll
- Size 59KB
- SHA256 0e8aa99dcc3bd5ea08c4a9f3cfd4e460484403a9400f37d3fe484e11a0cd4598
- MD5 84909c57d52ec9e427972f0f4c3286fa
- SHA1 cd3e5bac9f4126b4b6e22d4e2136e66d74c4f959
- SHA512 1ad1e87b9467a9888144c0be1dffab3942d1fb0c87a9487a1d98fa3e0e44238f2a024b85d18e444d3c56fee20bc9ce4415db32e2aa400a010558def6d4f48fab
- SSDEEP 1536:aNU3jYEZ1kFqP9v8zdQIg3AyKzcIi5x/od5wmckVPxIiTPmckVPxIiT6tKTT:a2haqPZ8kog5bod53ckVPxIiTeckVPx/
- TLSH
  T1B2537C9DB35400B9E4978278C8F31F46F672F80A17B9438F5768C2695F333A1663A366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  AVEVA PROII Simulation 2022 x64/Setup/AVEVAPROIISimulation2022.msi
- Size 492.2MB
- SHA256 3ced877f32ab56749e254110e7f5100dc6273a4ed3cdfff18567c485c007f9ed
- MD5 33efe73b09830af8c87594db9a4c691c
- SHA1 724d55297524a20916c80dd239554dd14de84f4e
- SHA512 31104eb61aeaa8d7576a16732d35e826cfec6a6068c88934ff82748c260df57c0ce8d91ee466b788d4f609ef5c943b8f0bfd2bec66ef63f8565ba2427915faf9
- SSDEEP 12582912:+qve8E3PV8xKgJubFMg5+yrc3e9+vUxZNEE:pj+V80gOn639vQNr
- TLSH
  T1873933B07501CEA1C425B132D41872FF78206C1AF2108E976AE67FAB79F67C13AF4566
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery persistence privilege_escalation ransomware spyware trojan
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- SmartAssembly .NET packer
  Detects SmartAssembly .NET packer.
behavioral5 behavioral6
- Target
  AVEVA PROII Simulation 2022 x64/Setup/Getting Started.pdf
- Size 5.0MB
- SHA256 6ec474e946f433589d90476a045ceb459beef6690d058e599995a90fc7490252
- MD5 ddedea57e049bb9f71995fee6202814e
- SHA1 01f8b153c83ee3cf838f263cf8ca25d976283234
- SHA512 b55c09fdb7a815b4f3bcea30aaab8de53d134280322ea42a511a516f59604fb082ff670a2da1a57447115b2366c51e2e4a37f97fb5735ef3a48e72820ee3006d
- SSDEEP 49152:b4OsZ5ynIWKNGC3EAKGboXYZC3owDimuruzoJrrW3a55UA9t1qfAHkvSR3+D/T22:bbQ5yIh0s8zWrWrAzMjvFD/TbKTC/
- TLSH
  T10E360138F3C3DB54CB0B813DA67C3D77639591E080C8995B668B4D897A81FB262532BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  AVEVA PROII Simulation 2022 x64/Setup/Microsoft .NET Framework 4.7.2 Setup/NDP472-KB4054530-x86-x64-AllOS-ENU.exe
- Size 80.1MB
- SHA256 c908f0a5bea4be282e35acba307d0061b71b8b66ca9894943d3cbb53cad019bc
- MD5 87450cfa175585b23a76bbd7052ee66b
- SHA1 31fc0d305a6f651c9e892c98eb10997ae885eb1e
- SHA512 36f295ed19a5bd5c5f05803ba26efd17d419abc7a791312ad011b63a4402492529aed0fb4d45ff1f74381079a310b33649c9c56c36e815b12e79ecd671897489
- SSDEEP 1572864:u6orjEvPz1cXD4hALCo8UXvOLKNnlv/iMqHzi8uGP0pBayi/7Js74etMyWUSS4g2:Z6jEpcXAo8UXvOuiMPNGsLE7Ji4SMlR
- TLSH
  T13D0833A66EF29671F1B324355570A8302523CEF22539E9CFC78A2C2CFD768C17572992
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral10 behavioral9
- Target
  AVEVA PROII Simulation 2022 x64/Setup/Microsoft..2015-2022.C++x64.Runtime/vc_redist.x64.exe
- Size 24.1MB
- SHA256 5d3d8c6779750f92f3726c70e92f0f8bf92d3ae2abd43ba28c6306466de8a144
- MD5 0c86174ca06d892881301203cdf2c32d
- SHA1 2b7462bb7732725f011a085349d6d206eed40048
- SHA512 16c1b043c81394bab65b40c5a9c5b742300cb605d9780226af725bf4d6e38c701f604549b2a3b2138ae951aadfc53faea66c97268c8c61c6c4f0771426ecca62
- SSDEEP 786432:4ipXDWoLTNOqMp5RUlODSV4YloO/Fa2XKS4POTsLK:JpXDhLTNJMpUEYloNS4PvLK
- TLSH
  T1E2473372A528413EC7B20577ED59F5202E6CA424331489BBE3DCDDAE6BB809162F7317
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral11 behavioral12
- Target
  AVEVA PROII Simulation 2022 x64/Setup/Microsoft..2015-2022.C++x86.Runtime/vc_redist.x86.exe
- Size 13.1MB
- SHA256 f02dea65ea65633d1718e6c5e5eee7d2df640d1fff332e4669dea530b8c4f0e7
- MD5 031dcfcaab554acd9a6d0ad252426411
- SHA1 23d7d69c27dc2781bb44b60359d9850e7bd73bb5
- SHA512 d6ae156cf6bab6aee72be07b4c752bdea78306d61dbdc54dde7f2e7e1ab0a94b408016d96336b626324b001b4cebd545bce7d9b997ad991f3aa1dee31a8327ca
- SSDEEP 393216:VwHQlptVYmfr7yBG/4U3J4CMxh6tLEuodNWvB:VCspttD7yBG/d367FKvB
- TLSH
  T179D63332A558003ADBF71873EA64F9241E79E528530449FBE3C8ED5E6E7804227FB752
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral13 behavioral14
- Target
  AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2008.C++.Runtime/vcredist_x86.exe
- Size 4.3MB
- SHA256 6b3e4c51c6c0e5f68c8a72b497445af3dbf976394cbb62aa23569065c28deeb6
- MD5 35da2bf2befd998980a495b6f4f55e60
- SHA1 470640aa4bb7db8e69196b5edb0010933569e98d
- SHA512 bf630667c87b8f10ef85b61f2f379d7ce24124618b999babfec8e2df424eb494b8f1bf0977580810dff5124d4dbdec9539ff53e0dc14625c076fa34dfe44e3f2
- SSDEEP 98304:vT4tlQ0aeY51XNURYxaA6qjEb9tRuPmBmWBDLTMTtbslyzRt9cuISY6Qa:vKlhE9U6476itR+mLPw6lyZY61
- TLSH
  T1982633EE1E32462AD70B42B2E4352783D578F0A68C7B8DD79D93553EE1E3266FA10046
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2010.C++x64.Runtime/vcredist_x64.exe
- Size 5.4MB
- SHA256 c6cd2d3f0b11dc2a604ffdc4dd97861a83b77e21709ba71b962a47759c93f4c8
- MD5 cbe0b05c11d5d523c2af997d737c137b
- SHA1 027d0c2749ec5eb21b031f46aee14c905206f482
- SHA512 75280d721550c2fa19b4f8d42b87d2fc6017f42709d84d2162c7330f7a0338bbd72cdc3f78626b10edcc602e2d22b174039254824334b3173d0ea48b3c06d1df
- SSDEEP 98304:hsPj6quMcylIpk4nM6tmMUrfvEP0hcKju9Z/lTPU8UBHBKNpr1w36ZyY:+PjzDJ4M6tmXDsPKi1lTPmHipJwqL
- TLSH
  T1E24633B8E0119B3DEED925F4677F14E74228D1A0D20371C76BD8B1CE6EBF289B25A540
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral17 behavioral18
- Target
  AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2010.C++x86.Runtime/vcredist_x86.exe
- Size 4.8MB
- SHA256 66b797b3b4f99488f53c2b676610dfe9868984c779536891a8d8f73ee214bc4b
- MD5 cede02d7af62449a2c38c49abecc0cd3
- SHA1 b84b83a8a6741a17bfb5f3578b983c1de512589d
- SHA512 d2d99e06d49a5990b449cf31d82a33104a6b45164e76fbeb34c43d10bcd25c3622af52e59a2d4b7f5f45f83c3ba4d23cf1a5fc0c03b3606f42426988e63a9770
- SSDEEP 98304:TsPj6quMBYyuSFOMKykvYgS/ylTpHufHMpPbOZ39c7T3eeom2vJtPShg:wPjzayuSgMKykQgSaTkvMxEYT3OfPShg
- TLSH
  T1FC3633A46437D2F2C8462DB0EFAA5F416CFD48B00684A6D877EC41D876DBAE244F7361
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral19 behavioral20
- Target
  AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2013.C++x64.Runtime/vcredist_x64.exe
- Size 6.9MB
- SHA256 e554425243e3e8ca1cd5fe550db41e6fa58a007c74fad400274b128452f38fb8
- MD5 96b61b8e069832e6b809f24ea74567ba
- SHA1 8bf41ba9eef02d30635a10433817dbb6886da5a2
- SHA512 3a55dce14bbd455808bd939a5008b67c9c7111cab61b1339528308022e587726954f8c55a597c6974dc543964bdb6532fe433556fbeeaf9f8cb4d95f2bbffc12
- SSDEEP 196608:19OaQ54oYY7jLwXjZ41OON2uk3bQWgtyccMEL:Gz5x7jLXkmkU4cFe
- TLSH
  T131763331E7B05023D6F201B2E411D528BD3DB2291F109CAAD794DD2D3AA9AD6E7F7213
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral21 behavioral22
- Target
  AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2013.C++x86.Runtime/vcredist_x86.exe
- Size 6.2MB
- SHA256 a22895e55b26202eae166838edbe2ea6aad00d7ea600c11f8a31ede5cbce2048
- MD5 0fc525b6b7b96a87523daa7a0013c69d
- SHA1 df7f0a73bfa077e483e51bfb97f5e2eceedfb6a3
- SHA512 729251371ed208898430040fe48cabd286a5671bd7f472a30e9021b68f73b2d49d85a0879920232426b139520f7e21321ba92646985216bf2f733c64e014a71d
- SSDEEP 98304:hQEKzHx15bWUuBrNatjJh2eNUrzKRL/RaIswn7aBOC5qZxVqFb2iExMc7FvxwGvf:WRDnuBotjJh2emr8L/YIsG7MOgqHG64
- TLSH
  T13566233296642033D6F10873F469E2217E3E721C2F1188BAD294DC5D3EA95DAA7F7352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral23 behavioral24
- Target
  AVEVA PROII Simulation 2022 x64/Setup/P2_RelNotes.pdf
- Size 1.3MB
- SHA256 fe028ba9c6b0e98034b959967bf9444731fc89ea89bbb7652c397d868a061924
- MD5 5b56cd9b4af4b2581e4c8d4a2f90c9fc
- SHA1 2937bf1556cbeac757bb134c463cb6666b04e8ab
- SHA512 92cbaae9a7262effb19ee8e00e7d979b0ffb70d42a73f1adfacf91c758ee8ca7ee11f6f2c1c5b27382e9687eef52c0a5df809a5ef06d2c5b35973a6b63fcae41
- SSDEEP 24576:leVBWp0IZkpytc9ff5vsWNYXYtSuNvFhXK2juq1O8vLeoHjNw5dtspVT/jl5cbhw:EViv6ytc9FBucSu9XKGI8vLfNw572T/p
- TLSH
  T1B755232AA382CA08DB3F883CA7BD9D36438991E014D56513758F4DD87790FB222576BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  AVEVA PROII Simulation 2022 x64/Setup/Setup.exe
- Size 400KB
- SHA256 b71f73dbeef844fe695f41961a7c755c7b397b837377e4175e141bd7ce9b5a58
- MD5 c847a2172d271bc8f3220220e0786879
- SHA1 709e85a92bb0f54982dbcd1fc89533a9757d1e7f
- SHA512 cab3351e13961970307f538bc6a725c0ff90e236b363bee2160bffbc1d21720dd0a1c1489dc290e4918fc6eee606213007777a83952c1f605cd14dd149e6ad2f
- SSDEEP 6144:JXaNjt6LuPHmLyiBvuJiFkJ+2Qw+MMq6FlOUeKJ6qja/ojDuUls/hwFlT1/p:JYYuUx65QwDMq6TOU6eDuUljB
- TLSH
  T162944C2226D48031E4E316B45BAD623157BDFC712B3489E756C023DE99B27D2BE3079B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral27 behavioral28
- Target
  AVEVA PROII Simulation 2022 x64/Setup/SilentInstallGuide.pdf
- Size 567KB
- SHA256 4dc6b241a45e3321d04d734a229162d3f088aaa43e80dc047141e9b8d08dd05b
- MD5 a9370abfde84e264ab466e8220fb7652
- SHA1 04af8d43b411f254a234740ba1d3940c3a0807f6
- SHA512 9a1ef09706ffb62454b31725a3a39609e99fdfcd7099a45dbb5053cb9722fc3df55cd878acb999510179c968ec448f56c46f981aeb0cbf6c00f8642095a274ba
- SSDEEP 12288:YxGVIRJMH+piGVNvKnIQT0XW7nnlAyR5NZsUCrrOqyiDH:Yx2cRprVNvKnIW0m7lAK9Craxiz
- TLSH
  T1CFC4127CF362D554DF4758B6AF2C0C9F22D2B5E4A681F009355ECC9A2782FA19412BBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  AVEVA PROII Simulation 2022 x64/Setup/ThirdPartySoftware/CAPE-OPEN/CAPE-OPEN.msi
- Size 984KB
- SHA256 790412ed06225f6908ece87d75c08d00d376cf25d5dcb2e8ae8015f108adec90
- MD5 87372f7b0014340126726043765b3b2e
- SHA1 d310c4c831f00ac99ae3743dfe8281016ffc7ab9
- SHA512 bfe4fc0f53a0544825028aa4e24da8c99f56924776ec3cd7f54b45a29c844bd17edc812f52af2d59a9db81773a1f39fed65f193527d1f9275a6e37d1bcb0cdd4
- SSDEEP 6144:1zPOBWsREaeSaRJ4JRpz/I/WP3M8XF9iyW1y48BxiKnWQ3:1zPOBbRmSxJb7I/Wk8Xle7Q
- TLSH
  T10B2519447AC601B8C65502774E3923B7E6979E1287D2A99A435C330CCEBFCF4A745ECA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

ransomware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtSetInformationThreadHideFromDebugger

Manipulates Digital Signatures

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Badlisted process makes network request

Checks installed software on the system

Enumerates connected drives

Drops file in System32 directory

SmartAssembly .NET packer

Executes dropped EXE

Loads dropped DLL

Enumerates connected drives

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks system information in the registry

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks system information in the registry

Checks computer location settings

Badlisted process makes network request

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32