9ec4b906b67aec3a748c97fb84fa5b61bade79362dc41518af4b2ec16eafdb74

Sharing

Copy URL Twitter E-mail

General

Target
Plants Vs Zombies.rar
Size 25.4MB
Sample260620-zrt4fshx2n
SHA256 9ec4b906b67aec3a748c97fb84fa5b61bade79362dc41518af4b2ec16eafdb74
MD5 c865907c881c61030461733e5812515c
SHA1 fb04ff1ecec0d3fdecbbc3dda4827d30c2a7c62a
SHA512 28441dab6def498f5715110fb5619e9ba4d8ea953fc726a314064866d4bfacc32ac5f5dd391554a815519da58f5b39909d420ec02090b1d2e68fb15040fd9fd0
SSDEEP 786432:tRaZmrnjC2kCJV5vDeRVug0oKYaZ3CR8ZOgoHi1Z:temmrezaWgziCbH6
TLSH
T1204733FD5E127A283EFE4781ABDCC6B9F960919E44F50FF4E58D15C51E0CAC8B262890
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Plants Vs Zombies/PlantsVsZombies.dat
- Size 2.9MB
- SHA256 6e60814dcf2ff2a511bf3671d54f641de648d88a4cd5b85b18313b123b40b8fa
- MD5 61c32386056bacb125336802a0ab0f36
- SHA1 30fa4c121a2db4712760555f08a481296cc54d82
- SHA512 06892e93886711ceb001738972e6693d121bd3b8f4aa698f3a40d65ce10151f1647f6a86fb9eebbc8513991de754394f6f6d55652076924ec024777e3a2fc2fe
- SSDEEP 49152:BmwphqxpWCvsZxsRU9FV0ZGzW1sc3aLl4tN7d+MXqIqPlmxr0zPX7KZ2u/xH1kdz:BmwhqyDO48R3aL+rmIqtwr0rX7KZ2u/o
- TLSH
  T193D533FF8929F630ADBB58976DB05438F74C91A527480B8F128E0FA95109DC6E3B5C63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Plants Vs Zombies/PlantsVsZombies.exe
- Size 1.8MB
- SHA256 9397ca2dc3a4560eba5f87aef40fd800786ba0312716729ccbdbda185abee27d
- MD5 3c8876147c84735ca540dda5be3c6451
- SHA1 bf5c51304b1bade29ba4988cc96bf9c35780793c
- SHA512 beb3b63d4ddae9e4a385da2ae9ed670b84ac9c8383c0649fcac31545dbbe4deab2ddb389a2c616bc9522b344e3a97ecb4775bc6858cc0d5b39497a8651602906
- SSDEEP 24576:cf8hAXlD2FNTPaPhpWTEDl6ufr+4ArTEJe/MTny14rR+6PMBquI+7yN2PAvp:WDAFS2TExeTD/M7U4rQaMvI+7yQPAR
- TLSH
  T19A95AF21B797C077C92702709D29D3789675FE6927748AEBB3D53A0E6D312D2AC32309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Drops desktop.ini file(s)
behavioral3 behavioral4
- Target
  Plants Vs Zombies/bass.dll
- Size 90KB
- SHA256 3627adef7e04dd7aa9b8e116d0afc11dcee40d0e09d573210a4f86bdc81a80b6
- MD5 6731f160e001bb85ba930574b8d42776
- SHA1 aa2b48c55d9350be1ccf1dce921c33100e627378
- SHA512 07ae0cb85464b015b35e6157228775a6ac66e5e62a1b47f9395307b61176b6df835e00a1518846507718acffc271263008cc8a9b2c1e8a0192c5438774e12437
- SSDEEP 1536:lyKkZPP882+8hMJ8Y8bRVYvVqGWWkaloy4bFcx/Rus5Ay6X0T3VzkxH9J:NmNN8bRVYNqGzCy8RQwXQ3pKdJ
- TLSH
  T1EF930199F5D17627C41A713D6BF203F3D0DDEA88C42B9F8D4E055B8028E79D96988F28
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Plants Vs Zombies/drm.xml
- Size 1009B
- SHA256 e3e85686b991ccf2d7a35a1e7923f33b35b8b9410f0f9e70b00218efa844a161
- MD5 91b07128556a1be71f1a6e161bf51678
- SHA1 080be51e8b3b545b134257e0139d485d09cd03be
- SHA512 adc9c894226396402d379aee4b6f892f1e5d9b60e39495c2aa41c4c2454098c605b5696b7554b6675f5cee44b72754d7f33b4cddb91a61ca784c4e053d667dd9
- TLSH
  T1F811D32260FA2235C077E900FC9CC42A6C15D5CD47BA1CE0BE46A6FB428EDA5427BF16
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  Plants Vs Zombies/drm.xml.sig
- Size 24B
- SHA256 d067a23707b632b77d5243388a116abdb5ff75abc7e35205ff2406081c46e152
- MD5 3a5ad3dbd85b4a5a6fef2c6105b29a0c
- SHA1 7aa783f68c69d8a4dfcf9b46d6a7c659071f9b8f
- SHA512 425ae8cef9f5fe84d7bfbce98184a63006be7da82ae7e87e9414f9649b82a563e054b2972c7c27617330383e06d8f3ff20e1e628687498aac7c9872b42421dfe
- MD5 SHA1 SHA512
Score

3^/10
behavioral10 behavioral9
- Target
  Plants Vs Zombies/main.pak
- Size 23.9MB
- SHA256 437ac2f28f26a40b957360d6a78f4c7c6d29dbbb210c4ddc58156b04d99fbb35
- MD5 26322dfc2ab49dbce3506d8fc5eb8435
- SHA1 7eabde6f3dba124c14100644576935c6f876606c
- SHA512 0e7fd65a687182cb89cf18d139d39e661682efd624550bf4671efb9de546c0e011fc578e6f479d788e8748cd311ea53d61aa7f14695e6df1a5ca4f35d8d9af0d
- SSDEEP 393216:/S92kitvqiQ2iGiHiJik4i6i4iTzitiFAyq8lQyl/TsPYfunaClFh8foE2/WQa8B:/S92kitiiTiGiHiJiVi6i4i3itihblha
- TLSH
  T1A7472369FDD338C0596ACD40516232BDB07DA7F5BE4451117806BB92F93280F2B2DEAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  Plants Vs Zombies/properties/partner.xml
- Size 232B
- SHA256 afa83947cffe8cefa9fec0850148bf15a7c4ee3fcfb6972bdf29bd65085099d4
- MD5 1b451217527cb2fdbf68da1995a90802
- SHA1 58c72f35961728a98439a6b4ac9156afa7a7f25c
- SHA512 6ce9acfb3a69204ffdbbac8626a8dedc3b518543159d736c69620a83cb13fdd09dc5981a8ca7c80aa2b39edf54d8d5e19111a729542c11697c039b6bf7c6e978
- TLSH
  T106D0A703B4F9092446F3D428B88D06728C08C4ABC37A48F0FE89335B620A0F71013E22
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  Plants Vs Zombies/properties/partner.xml.sig
- Size 24B
- SHA256 e59e7b89a543d3b32b85c2da43744217ce20a37081342860e2cf5bede2c5260b
- MD5 b8788d4643890d8cbda2db5d5ebcb507
- SHA1 65d3f64187c667e2fc874e938cb77cfdbf4d3a38
- SHA512 3d82171b662ed7c98f062cf9b542a0a5f8ba7bd144fefca7e302ebe36b5f09aac3831ce4832fdc5d16d31cc31609b20e569dc0f717cb25fcfe41d3c384aa63c5
- MD5 SHA1 SHA512
Score

3^/10
behavioral15 behavioral16
- Target
  Plants Vs Zombies/properties/partner_logo.jpg
- Size 5KB
- SHA256 8bea233c40ddf74decf3ddd0a3d4cef8e1229ca3a756384e78d319aca0b63113
- MD5 834e499dfc1116d26c3b229f69019149
- SHA1 6eb52bf63ec5265faa360abebf2b7f634696f0b1
- SHA512 c5ac5f9b41ff6af9d132c0f4c8a9e6a841261f24bd7e9eaac1864d87489639516af348271e11b60df959711d65af9bdc59337d0d6a718cbd10f17beefd93380b
- SSDEEP 96:QmkRc7wS6P394hdqW+53qcPnBRZ+XT6u7H1NKZgKgsH13AapOEz:Q7RB/P8dqOUBaTr1NKZQsHCKO4
- TLSH
  T1BDB15B7E6927CC56ECEE4039565DCBC9D2214B86B44BA92D78225B85FFA1EA10C0B202
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes dropped EXE

Drops desktop.ini file(s)

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18