60c4632f3bad71f86f738c1104256f581c95bfa84069e2f5fb2c1b2b7795080d

Sharing

Copy URL Twitter E-mail

General

Target
AutoTweakerSetup.exe
Size 57.0MB
Sample260530-e7bltsfz7q
SHA256 60c4632f3bad71f86f738c1104256f581c95bfa84069e2f5fb2c1b2b7795080d
MD5 393c8a6312ba5801390d4a1153c1d809
SHA1 45940440bf67bcb2f2f00bbf5e6cc7e3a821fca9
SHA512 b79ee2d1eec436c84bcb88dc159ac4aff826b4d8c5b8740ebfa018ec2d1ddeca7b7480640172b3d52c695e72c477335e1ab8102281bd23370ee5df849e265c2a
SSDEEP 1572864:mnU1HPKRtnP4slDJhjvoxyjUV67611Nx5Qr88D77:mnU1vKRlP4s3vBT7IL47
TLSH
T1FED73372A35408D5EB839071C2AEBB8441739EB730D2E1D27610BE6A2DF4BE7CB19157
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware

Malware Config

Targets

- Target
  AutoTweakerSetup.exe
- Size 57.0MB
- SHA256 60c4632f3bad71f86f738c1104256f581c95bfa84069e2f5fb2c1b2b7795080d
- MD5 393c8a6312ba5801390d4a1153c1d809
- SHA1 45940440bf67bcb2f2f00bbf5e6cc7e3a821fca9
- SHA512 b79ee2d1eec436c84bcb88dc159ac4aff826b4d8c5b8740ebfa018ec2d1ddeca7b7480640172b3d52c695e72c477335e1ab8102281bd23370ee5df849e265c2a
- SSDEEP 1572864:mnU1HPKRtnP4slDJhjvoxyjUV67611Nx5Qr88D77:mnU1vKRlP4s3vBT7IL47
- TLSH
  T1FED73372A35408D5EB839071C2AEBB8441739EB730D2E1D27610BE6A2DF4BE7CB19157
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/modern-header.bmp
- Size 9KB
- SHA256 8e58b3e6e3896a4bae05fa2f6adc238d391aa80bc51c138f851f373c6c23e518
- MD5 eadf80c79f88337c58ca0fb5032cb579
- SHA1 523d7118a3755790eaddd6e99f7b3814e97d47d0
- SHA512 ed612cda75f4b345c1405be33575a0060d6399654d66356e8102ec82a057497ef7dc99906132bd729ae793e7fc4f46cdbd57256fca567a056bed642c1d58b7ed
- SSDEEP 192:6K3Taw+vLvvswRvyb7qY1eL5qDJD8CUNObWF/U0p3+i8Esub:6MOLzYQdqDJHsxcWPX
- TLSH
  T1681207AEAF1C6F539E71D2D9EA21188D1902861CF51ACEEC7E8F24055763B54267CFC0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH
  T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH
  T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  Bridge.exe
- Size 315KB
- SHA256 38c901914fa977ac27ecc76aeadb216d2ec806ec69307790798a8e30ea1925d1
- MD5 aceec939b62be3a5181d76069322c2cf
- SHA1 6bf871b6594b233e3287e951deee6359502cf301
- SHA512 f5a42730a46a4640f318deadc661aa7572bfc225e37b39a1e360282b9eb5c4855f2e5b7e8d7e2ec363a8f245eac086d15fb98b16c3beb27d301ae5667a5d09db
- SSDEEP 6144:LTkH4xD0vWwceRYmwy901X0GNaLlt0fbZvZq:L1ZYu
- TLSH
  T12C6408C2EC071AE9F6E6E63975A13323F86737960A38C73F25C05D62551878092AF74E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Executor.exe
- Size 6.8MB
- SHA256 9c9970bf7de7b8b907605a58869e23cd77d8991191a9a392f9a01bbf134815a3
- MD5 87a53f8e47a83552452b6f5a7ac9c5e4
- SHA1 99f065bffb97dbb95b9e4952fd33ec9414fb5953
- SHA512 8fa3ed0e82045066d81a5b296dd50a098ca2b994982380752f2a12cc94fad833d10544990d94758250640d11ebaf15cbf1fd21359ebf7874ad799a54a793867d
- SSDEEP 24576:V+NbN2NUN1NHNSN/NZJ/TP1n1Lisi0i5ibiIiuiki1ieihiNibiSiyiYidiqi1i2:2vi8XrtoQ0xDBbZ7dpjeIJcY2E
- TLSH
  T18B76A6C29C0356DDF9E2E63636A93723B8633B561A2DCB3F58D05C72511978092EB34E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  LuminAutoTweaker.exe
- Size 200.9MB
- SHA256 91bb36fb598b49b08ed115dda2cf311acad808e25c8aa1feb9642e2f2420e565
- MD5 542d144d4c8df706551911eecc055f35
- SHA1 8a6fea37be12b910d3a4cd03376eaafe2d933bf1
- SHA512 6904f583b6dac2e89f353c93080db6ec94d385b4ccfa91d7eb03565e9d3767c27f65d8aa13f3457111002fed9792ecb3ab3438364cec10eb7d0038d00da829e6
- SSDEEP 786432:l4b3mYETdcak6pobIV5OtsFTbSssc7JCZjHGeAZT2ud/nF9PQG1BLgFBPtmnXYcB:o2YSdGmoUxSssKQmdauBYG7gFBMIoPx3
- TLSH
  T183A88D15A3D85629D17BC234C7728662D6F0BC629324C2CF1095FA193E73BC16A36B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
behavioral15 behavioral16
- Target
  dependencies/App/A9C3L8D6T2V5X1J7
- Size 1KB
- SHA256 befb7f4d222498218c026f5c8e428d9a9293884437bd7a78be1d5bbfb4f377d2
- MD5 ff471af85d320d06e8976d73291579f1
- SHA1 b49dfcce2b98f5e57d59507a6d68e1611d43b624
- SHA512 53e3c7dc51a2b423567ca5d50e34d1882039f1c558e858f2b0b87ceaae8e8845e4409ecbd317430f31d8ed13a2f953bacad1874972c34432e4b0d634cec761e7
- TLSH
  T13731B8A4E816CF25FD58DC7104A673041AC287E89E52AA1B1580F7362D3ABC16913EDF
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Lumin.nip
- Size 20KB
- SHA256 26458fcd1f59ad8a2b0cabe741eff230c27648ef0ec61c809404d65c02430165
- MD5 4337019d89fcb829ede9cd87996da4be
- SHA1 533f9ac3c2ed62811d958b246c36b09fdf322e98
- SHA512 e1fafcad111cad987b5f15947c12a8433db42b0a9c583c5d4a38c894167bbe832791173bbe5eda81beddc02af3fd9d51fbbfacc826908b04efd06c117c913d5b
- SSDEEP 96:PKIRZHo7HMHUHrHAH6H+H1HYHSHiH6YTHZY82wHZYcH8THSHgHuH1HBaHIsHCH52:iIO2DQ2HRIfyQee21Itq
- TLSH
  T1DA92C06D25C56A0FA2385DD6F66A9339DF28612704534070B89E760F2F379EA03E7E06
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  dependencies/App/H7T4Y2B9J6X3P1D8
- Size 1KB
- SHA256 b55afb9ea1de00d2b69932e220e67d7c44ac75b29b887ed55e5ca1fc9de1e20a
- MD5 942b29bd805b6c35667ded4b2d6b1cd6
- SHA1 e7e36e31f1ff7d4d59211e73c1b9df38a9820e17
- SHA512 5f1d6719415146638f172cad16ab527f1a82ea7d8545ec1b366aa2edc6eac4f46771b7569443a49e0a84b8b5dbe3ee514ebe1e7aad8d55de94763c6ae257c36e
- TLSH
  T1564119B2F1713695CAEB443460828D9CF14F8A7314C29AC2EAB4560C2D6E542D99008E
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Scalability.ini
- Size 4KB
- SHA256 c23f3ff3be71c0a8b8195a1c894c4ea50d441a19f731d741626f0b6b12ea8539
- MD5 bbdd35fc5ab4abd301c82edc06034828
- SHA1 2360890ac00c851350e21c7378128976b490a1a3
- SHA512 c3d2ca5139c5cf486a7a36bed177457f93389443de2c68f8a2cffe6f0b8046bf39849aa24d54b4d8e90b670b6f80df48c589b4219ad0aafd0174de25d28e8fa8
- SSDEEP 96:3SjXGujaMmL1JREVJkJqJ0JBJF5NdvLZrsOk4Z6++XC6NAppkB2L98:3SjXGujaHL1JR6WYWzX5NdvN9kS4DNHz
- TLSH
  T1DC91B71A86302503AFCF423DB565179E4E3D5D97443F29A4C436824DF5CE08F9A8CB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

ransomware
behavioral23 behavioral24
- Target
  dependencies/App/K8H3Z6N1D5M9Q2W7
- Size 3KB
- SHA256 e3d9f55f72255f986c286ca57deca3eeef6c7c7b1ad603a55cdc4b55270c14d0
- MD5 b208dbc1f29b5ad95861c5c0582fcca0
- SHA1 e2587d196c665f066507cf81f4f14135f03ff79f
- SHA512 099835acc57498a9e06ac948d8eeb114b863ab11f658c9b09edadf86ededd88166eee50a9d619120ff61ddc863d1d1c0ab1ab486542fbf51b7424ad7e1e087ba
- TLSH
  T140617C7C623294C9DA9E86FCE406ED0A92950978C056D2EB2BC68FC750522A07961B0F
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  GameUserSettings.ini
- Size 7KB
- SHA256 cf21092671adeb1aa23bd9739a5f466d730e91161a5a260931de6afcebf3ae26
- MD5 59e606e93f62ba0705be3f4714ebd110
- SHA1 87c499176273a22b7afe460cde1e6e2818ab3a4d
- SHA512 8404ded99607840d15cc576b65f0d40a45e61c6d5850ab3332cf9b854637240eaa7494b29880bee5887c112521d109f4d6b1fb60b58de999b5e4b31619f1fa13
- SSDEEP 192:hfqig7bARtYZ1LK0vx0+iRk5piMx3Ffuiymu5wN011N+Sauiv1x45g7/EVkk:RIPARtYZ1l50+G7KFOauiv1x45g7/Eh
- TLSH
  T16BF184E42C201092D92791BBBCA7F01314F173AE51DF5408BBC6A71B784DB88A5CBA3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

ransomware
behavioral27 behavioral28
- Target
  dependencies/App/M5W2Z9Q1F8R6N3K4
- Size 2KB
- SHA256 be48cb265f14218e1a458887d1e6d7885256941ab6a8ea00ee83509cc4790a4f
- MD5 a70114ade864636054026852110a7aea
- SHA1 1c776053433f19618a4beb104503a45bd028c6a2
- SHA512 a51a17845b01314cdfdcbaab1f74a5c846d30adc6caf2c89aa8ce974c10c8d1aa547427c63a5b2c44881423a90b940cfcc136ad9b616d40bf250b8676c14cc4d
- TLSH
  T1E5411AB28C2413FDFE4405FA09485ABD5B6ED4A523F2DF6188F474881F4DE625E1E250
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Engine.ini
- Size 5KB
- SHA256 9cd816663df4da08ee3f536e0309ac8dca55bbcf7ab0a68bc059bb35cfc20e05
- MD5 cd018d59c42578822bcbf2c448409f5a
- SHA1 a3ae45e028431fbba2ee3c083203bd971ee9b05c
- SHA512 75163f8be4bfd0d45f73e47b7e6ab93edb9e531a2cb33915be7d3d0702d7881abc4f6dadd6776da52e43b8f56c24f9d2bc88ac212669ecdf9590c0db050cc30a
- SSDEEP 96:x+XceOsfJkJqJ0JBJX5bJhSMpjwpo8FOqVJOc/TYBoal1Le:x4fOMWYWzZ5bJhSMp8DFOuJOc/TYBoZ
- TLSH
  T1A8B184155A653544AF86523EA872679E0F3C2823007F64F8F83E928DF7DA04F964C728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

ransomware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Checks computer location settings

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32