c3e8136abb1cb79cda5fcdda8fe60be161db4148f936fbb8c84f20cbe055ec39

Sharing

Copy URL Twitter E-mail

General

Target
SimpleTTSReader-2.0.4-setup.exe
Size 22.9MB
Sample260601-ay45kacy2m
SHA256 c3e8136abb1cb79cda5fcdda8fe60be161db4148f936fbb8c84f20cbe055ec39
MD5 29287e8af6e3e80463cb63a15afd1f10
SHA1 3982a7b9740d80d30ddeb66080ac38ab47a8853e
SHA512 8ac37e8926e554e59074291d7fb61b4a158f1a2d33d93e2226a57c5799ae7b3787f7233eab276d97dc820321c761c6e42f193d21a9ad79581089638b8dd4f26c
SSDEEP 393216:HWfm8HD5r50O4ajfl0JseN6O/sN0wQZTbqrJarbZpKYtThnKlzW:HWfm8Vr50kreRE6F0SbjKYdhnsW
TLSH
T1CA3733B965E9CF3EE774A0B55029630C0BB194BE23253C7ACE1D5FA1C807D124AF85A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  SimpleTTSReader-2.0.4-setup.exe
- Size 22.9MB
- SHA256 c3e8136abb1cb79cda5fcdda8fe60be161db4148f936fbb8c84f20cbe055ec39
- MD5 29287e8af6e3e80463cb63a15afd1f10
- SHA1 3982a7b9740d80d30ddeb66080ac38ab47a8853e
- SHA512 8ac37e8926e554e59074291d7fb61b4a158f1a2d33d93e2226a57c5799ae7b3787f7233eab276d97dc820321c761c6e42f193d21a9ad79581089638b8dd4f26c
- SSDEEP 393216:HWfm8HD5r50O4ajfl0JseN6O/sN0wQZTbqrJarbZpKYtThnKlzW:HWfm8Vr50kreRE6F0SbjKYdhnsW
- TLSH
  T1CA3733B965E9CF3EE774A0B55029630C0BB194BE23253C7ACE1D5FA1C807D124AF85A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH
  T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  License (Slint).html
- Size 4KB
- SHA256 f81dca99350d63ea61dc329e3a54714b7eee89c902c8383db32fb6666a402884
- MD5 60f4f78cdc6c733f53ec80b94fbc7f77
- SHA1 5b0328ab0528642632fe170d3b9f839631830f3b
- SHA512 a3d4acccc5d5bffe7189aae0c0021e931d794c3bb6d584d0d5ec09a1cdc573843d3bec3f19debbb03ff4e155aab81b6269c1438c79e36826cd519a1c06a3bf41
- SSDEEP 96:UkQbV6yJfQ/fOk+xaPK5+lk+l4++F/gxIPHiBGMb:UJbVTwfr+xaPK54Lf4gxIPczb
- TLSH
  T16E8155FEE209A7A30BC6029B174961DDD23E506C39D612F2709BC127620686403BFEDA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral7 behavioral8
- Target
  License.html
- Size 88KB
- SHA256 5444923349eac7a0d3ae9eeabbb88b984afeb7dc24e965079a51e5745fb568bb
- MD5 b207049a401e206139ae3d97a4bdb3cf
- SHA1 74fb4d2ff8ee97d60502cd292a2839c362bece81
- SHA512 1dee2c4c96a861df72077c3b4f7a032a4f0195f1ea4c3d5e18bd65b25ff522f9ec517542dbe2b11cccd57ddb6b0f79c5f0c4258b67f07fbbda949a31892ede99
- SSDEEP 1536:rvJUaJBQvJUahBgvJUahBoR7iAZKsjDd/RNL7rhfVfibR7iAZKsj9dkIi:rRJBQRhBgRhBoRGoBjDBL7rPfyRGoBjY
- TLSH
  T17293943F7698037706C60162BB9765CBF21FA03F3B5A2A54305CD0281F6B96543FB69A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral10 behavioral9
- Target
  VC_redist.x64.exe
- Size 17.7MB
- SHA256 8995548dfffcde7c49987029c764355612ba6850ee09a7b6f0fddc85bdc5c280
- MD5 23985a8a66ae306aedf0a9feb1a3d14b
- SHA1 7ee9442ceaeef605ea66849f042b8410433c988d
- SHA512 b618f601a1989a696c8efa0208efd977a3bfe9a8df8ace8fae9eef20262240e7eefcb67ce466fe166bdc606d80d594d2de80b3b4e530749aab8e99f5cecd86d4
- SSDEEP 393216:Sr3bJsxx3E2DiCLwmQQp5MTFarWznCY1LHRqLJ:S3mx3D585AI+WDCYZHRw
- TLSH
  T1D717333160A0413BFBF51077B928A2202E7CE73C2B5598BAD7D8AD1D7D6A84147FB163
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral11 behavioral12
- Target
  simplettsreader.exe
- Size 13.7MB
- SHA256 84fc1ca2537cc8b0e389957e322afb525ed556d57936ac6bfbe6aff856005118
- MD5 2d087195e97f3b9eec0fcf0774497cd1
- SHA1 02d3850f9c29688a19d30445c69a7a4bf2f2a3e5
- SHA512 7f5e58dafd2888e237f2c06ab26338a7e58fb1b22e3c25cb85c8b9d3d7d1a9cf321cc901c1d499f1772b3e11cbddca52cb8d362982f47e04177d54eef9f04cbe
- SSDEEP 98304:jCgCmrGLf8USBjOWlheQS4Gcbf98L1Bu3AIchIOTmvV2UHBb6fshWU2:jlfLBiW+QS4piIQsVRHBb6Cw
- TLSH
  T1ECE65B42BAAB99ECD19AC470834696376A2134CF0B3579FB46C496383F79BE01F39315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14