7274586cb56181569512c84593935a23c0d150314bf055ae7388809d735acd86

Sharing

Copy URL Twitter E-mail

General

Target
_SolidSQUAD_.7z
Size 15.9MB
Sample260621-emccmabs8p
SHA256 7274586cb56181569512c84593935a23c0d150314bf055ae7388809d735acd86
MD5 ac34c8ea4e8ff9e2a97c1db08730d8f4
SHA1 9a8adc7f5b65de837d304778b5d8a7b1313174c2
SHA512 de184968405be7cecbf1c87a8a804d096136982117c6650e46ab73a2d6bec71594f4274e6105f2f92c3f6da38aea4730b9ac1fb7a3b47e1e46187c7480b49a7b
SSDEEP 393216:a5BpzBc4OFW4ZhfaALET1s1yaHzj1TqZt8j4Yua0laH:a5qTFW+ftEvaTh2ZtM4Yz9
TLSH
T1CBF633FD2FE44E40A18F912B543B668A54E0CEE32DFB2AA4188CD0391F7EB51E457B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  _SolidSQUAD_.7z
- Size 15.9MB
- SHA256 7274586cb56181569512c84593935a23c0d150314bf055ae7388809d735acd86
- MD5 ac34c8ea4e8ff9e2a97c1db08730d8f4
- SHA1 9a8adc7f5b65de837d304778b5d8a7b1313174c2
- SHA512 de184968405be7cecbf1c87a8a804d096136982117c6650e46ab73a2d6bec71594f4274e6105f2f92c3f6da38aea4730b9ac1fb7a3b47e1e46187c7480b49a7b
- SSDEEP 393216:a5BpzBc4OFW4ZhfaALET1s1yaHzj1TqZt8j4Yua0laH:a5qTFW+ftEvaTh2ZtM4Yz9
- TLSH
  T1CBF633FD2FE44E40A18F912B543B668A54E0CEE32DFB2AA4188CD0391F7EB51E457B15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral1 behavioral2
- Target
  SOLIDWORKS Corp/SOLIDWORKS Composer/bin/netapi32.dll
- Size 423KB
- SHA256 37014d346ac9a3a715cfac404d0c6fbdd0c107f3dabc301a4cf4c643b3bafcc1
- MD5 ebf35e586e43ff8647a3b7867320217d
- SHA1 9c040ce7f680c32a262a8484c383590c794f1588
- SHA512 d7eb47f8fd60d1a64cd59012fc3c31a0fe71df121e5ca05dbca33183397273150f963583cfca6910ba909b8605f9688a1d70b164cc4197666f0a7c9459ca9051
- SSDEEP 12288:hTXOA4wjp0yPUHk36dTa9faPANFrAe7OTooi05t:5XPegl3H9FUUoi
- TLSH
  T1CB94E11A73980876FC7B817988931A42EB76B8025720BADF0350077BAF5B3E5793DB54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  SOLIDWORKS Corp/SOLIDWORKS Electrical/bin/netapi32.dll
- Size 423KB
- SHA256 37014d346ac9a3a715cfac404d0c6fbdd0c107f3dabc301a4cf4c643b3bafcc1
- MD5 ebf35e586e43ff8647a3b7867320217d
- SHA1 9c040ce7f680c32a262a8484c383590c794f1588
- SHA512 d7eb47f8fd60d1a64cd59012fc3c31a0fe71df121e5ca05dbca33183397273150f963583cfca6910ba909b8605f9688a1d70b164cc4197666f0a7c9459ca9051
- SSDEEP 12288:hTXOA4wjp0yPUHk36dTa9faPANFrAe7OTooi05t:5XPegl3H9FUUoi
- TLSH
  T1CB94E11A73980876FC7B817988931A42EB76B8025720BADF0350077BAF5B3E5793DB54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  SOLIDWORKS Corp/SOLIDWORKS Inspection/PDF/netapi32.dll
- Size 423KB
- SHA256 37014d346ac9a3a715cfac404d0c6fbdd0c107f3dabc301a4cf4c643b3bafcc1
- MD5 ebf35e586e43ff8647a3b7867320217d
- SHA1 9c040ce7f680c32a262a8484c383590c794f1588
- SHA512 d7eb47f8fd60d1a64cd59012fc3c31a0fe71df121e5ca05dbca33183397273150f963583cfca6910ba909b8605f9688a1d70b164cc4197666f0a7c9459ca9051
- SSDEEP 12288:hTXOA4wjp0yPUHk36dTa9faPANFrAe7OTooi05t:5XPegl3H9FUUoi
- TLSH
  T1CB94E11A73980876FC7B817988931A42EB76B8025720BADF0350077BAF5B3E5793DB54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  SOLIDWORKS Corp/SOLIDWORKS Manage Client/netapi32.dll
- Size 423KB
- SHA256 37014d346ac9a3a715cfac404d0c6fbdd0c107f3dabc301a4cf4c643b3bafcc1
- MD5 ebf35e586e43ff8647a3b7867320217d
- SHA1 9c040ce7f680c32a262a8484c383590c794f1588
- SHA512 d7eb47f8fd60d1a64cd59012fc3c31a0fe71df121e5ca05dbca33183397273150f963583cfca6910ba909b8605f9688a1d70b164cc4197666f0a7c9459ca9051
- SSDEEP 12288:hTXOA4wjp0yPUHk36dTa9faPANFrAe7OTooi05t:5XPegl3H9FUUoi
- TLSH
  T1CB94E11A73980876FC7B817988931A42EB76B8025720BADF0350077BAF5B3E5793DB54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  SOLIDWORKS Corp/SOLIDWORKS PDM/StoredProcs.dll
- Size 13.3MB
- SHA256 effcd49e1362c89d23dd69a19c5c4aac03b0092423a5e3324440f6e731fe9d81
- MD5 2113fccdd4b55836be7c4bc5e1f58232
- SHA1 19fac0a05475c068dfe08701bcb36f02a86bf166
- SHA512 c76e2b79c7acfc9f6cb63be513b8ff7098374b32c69c6b4f704f8c4c9be67879c20c3dd542d353a09217c02800d7aae1514bdcdb1ee576683fd9b60ccf4a83eb
- SSDEEP 98304:HlWfW5Npbqu82QXeAy1QumuWZ3E5x1Y7Mhv:FWfWf9qjxN21Thv
- TLSH
  T197E62912729A0D64F0B7C2399AA688D2D9B37097273195DF309CB1091F3EFD49A7DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  SOLIDWORKS Corp/SOLIDWORKS Visualize Boost/Bunkspeed.Common.Licensing.LicensingSolidworks.dll
- Size 39KB
- SHA256 b383ac67370d468715dc3c5a21d40181d5dd11ba8fdbd8a5e7b61ceeb8c3c5da
- MD5 944f649524f5d47893c77fcec7e19bf1
- SHA1 fbe848ea509d0c30f14075d4ab86c7315ef4d021
- SHA512 f9db0e509fe934c8b373775aaf8eca54125d5411452617cfbaba11ccbadf5175282b5a9910a5e30e2aed7ce9c34c6654d5ee14ffd101c628132b186279d79d42
- SSDEEP 768:p0gHlcxYSdAv10NqQ3l5OUgRhnJjwtp6kiMR5nCQdiSWGkqCX2ehQud2Tb6lviHp:RlCA+v3OnJY95nCQdbVkqCX2or2Tb6lI
- TLSH
  T14D030A964BE40726CFDE1B7EF86602050BB1F6A66872D79E874480ED26227C54F133B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  SOLIDWORKS Corp/SOLIDWORKS Visualize Boost/swsecwrap.dll
- Size 2.1MB
- SHA256 ccb5032a9c0ff525077c1d4d2d3ead3e995a05ef114b6547afb3c0b246a99da4
- MD5 4e44fe84babc096da9ef4fd3b41cda1b
- SHA1 a250afd784c73cd3163c5e5fe50c81ca2d7bb0ac
- SHA512 29fb6b113b2fb969fb04aede4e63bec239297ce3cd49b20a06c656122e5d242e05cc67aa1015847dd4571cac7acca97cd0a3d4109920f88785d098666b0dadd3
- SSDEEP 49152:yAaPXMZlHneKfgVUfcZRMp5tVLGKgB7YR0SESt6:e8YB7YR0SEW6
- TLSH
  T17FA55C02A3FA21F9F0BBD23886664627E5B678452334C6DF037047661F27FE099B9725
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  SOLIDWORKS Corp/SOLIDWORKS Visualize/Bunkspeed.Common.Licensing.LicensingSolidworks.dll
- Size 39KB
- SHA256 e62aba04aad58de6c5c37388baa3f5819232e6669d87f0ad9abcb8661ca75f11
- MD5 19305e8f1f05f29bb577d2087a68c9fe
- SHA1 c43b94fadc300315a05c7486b8c3f4d01a0f603b
- SHA512 a0388150db56ba86763ebee4b392c4e5071a9240cd3270276cd25078f34ac5775b4229b7355fac0bb7aa1e3a35f6cfd357963cd552ada803ad9e48bc7bfc2e9a
- SSDEEP 768:10gHlcxYSdAv10NqQ3l5OUgRhnJjwtp6kiMR5nCQdiSWGkqCX2ehQud2Tb6lvkHp:dlCA+v3OnJY95nCQdbVkqCX2or2Tb6la
- TLSH
  T172030A964BE40726CFDE1B7EF86602050BB1F6A66872D79E874480ED26227C14F133B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  SOLIDWORKS Corp/SOLIDWORKS Visualize/swsecwrap.dll
- Size 2.1MB
- SHA256 ccb5032a9c0ff525077c1d4d2d3ead3e995a05ef114b6547afb3c0b246a99da4
- MD5 4e44fe84babc096da9ef4fd3b41cda1b
- SHA1 a250afd784c73cd3163c5e5fe50c81ca2d7bb0ac
- SHA512 29fb6b113b2fb969fb04aede4e63bec239297ce3cd49b20a06c656122e5d242e05cc67aa1015847dd4571cac7acca97cd0a3d4109920f88785d098666b0dadd3
- SSDEEP 49152:yAaPXMZlHneKfgVUfcZRMp5tVLGKgB7YR0SESt6:e8YB7YR0SEW6
- TLSH
  T17FA55C02A3FA21F9F0BBD23886664627E5B678452334C6DF037047661F27FE099B9725
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  SOLIDWORKS Corp/SOLIDWORKS/RTLibraryManager.exe
- Size 6.9MB
- SHA256 216d7d5af65f8165384eaf54c8faff4e5b4c9d8caab50edf6af9f9be30e0e964
- MD5 431dd415c3814b29547822c9df504e31
- SHA1 d98397133bf1460a71b1fc9a62230dd637a49b76
- SHA512 db5ea8ab9a26ee027cee862f393b8764b3db2881d49cbedb4165459ac67211b8c5a050082fdf34226d9ffe077a3e957d76e6ea606ad7e8683ee1ce4b19784ea2
- SSDEEP 98304:L9D4fXLr7gHfZ2Zj4o4Kkix5fzuZPOzRcUt/oerc7+x2IidKh8e7IN64IN6dJ8RO:L9Df2ynetqFcoer/n8esN63N6U2
- TLSH
  T169768D38B15C1E0AD4FA41F0567D6738C9716E5E62C391B63BAE365A8F723482D0F272
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  SOLIDWORKS Corp/SOLIDWORKS/SldToolboxConfigure.exe
- Size 9.1MB
- SHA256 a6d6507d1a047af58c553f669320142ae3c365185caec756639b74e54b211d3c
- MD5 08b709bb5a56e77c34e072f457f43a91
- SHA1 098e3950025d5bb02a1d0fe539d57831056fa97c
- SHA512 1b5793e04622e6f9f7e98850d7f8798251c1271fe48cd1051513cb651bd550740dc5b9a0aaf640458ff476d01c0fb5189a4d6283c252ae8294641dba1a96e365
- SSDEEP 98304:wv4/kDGLGoM3Q/jMTBNNteIXI57OfC03rZNGZDnbqKUFF35MdOnb4TDn5NkivVlN:wvvWQg/gNtlI5ifC2rZosMC0Tj52
- TLSH
  T1C3A6BD31236A8E90D83B0132506CC338D9A36F5D75D3813A3DAF7B9DD7316807A5B6A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  SOLIDWORKS Corp/SOLIDWORKS/ThemeEditor/PresentationStudioThemeEditor.exe
- Size 2.4MB
- SHA256 f72f087e5531d2629c0179a898141d44aa6514dab7933e239f14b3a479736b4c
- MD5 92a046c7e7860f92a38b7946c781c57d
- SHA1 a63d609d5da0551cc106e232d39a10cd4bd073e3
- SHA512 af1678b3a1ce99f9c96e5eefde15d3ff3bbda87b45a7a75d1e4e17a561a7a3cd7f2c91b2bb4cc9d8ac740e065d601af59e9610af8dba55c52602415806571202
- SSDEEP 49152:OonL5J+Pt/YK5yeRvKWyWe0ojm/gcdDo:Osj8tAOyeRToy/gcdD
- TLSH
  T1E6B55C326755CF04CA7B2675D08D472C95621F4DA993843B35AC3B9D8BB0EE82E4F392
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  SOLIDWORKS Corp/SOLIDWORKS/sldutu.dll
- Size 3.8MB
- SHA256 fcc1909afa0f4f7a8a5f33ffebc451b4f0768183ccb9437df230627c8748384a
- MD5 7ad9bcf13f9d61f3fc5ab2828ff2fe81
- SHA1 719f5be61bb186d30fa84030a3fd3d88a0fe746b
- SHA512 2bbe9c1723f406346aebb302190f1ddcd3f28683c4449c85db0de29391820b23d3c148d2657159d6c0a970ead312b9ef68bb3b5634bffb5bfc89eabe31b0d113
- SSDEEP 49152:yhGjTwi0AqRHtHdrR0yjsrWgpW3jl/zM1KMtHAkJaFIcJjW8WEj:ly7HdO+zBjxj
- TLSH
  T1CF164A0396AA11A4FDA7D2388AD6FD13D0BE7485C3B586DB032946150F27EE05DFA3D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  SOLIDWORKS Corp/SOLIDWORKS/swsecwrap.dll
- Size 2.1MB
- SHA256 ccb5032a9c0ff525077c1d4d2d3ead3e995a05ef114b6547afb3c0b246a99da4
- MD5 4e44fe84babc096da9ef4fd3b41cda1b
- SHA1 a250afd784c73cd3163c5e5fe50c81ca2d7bb0ac
- SHA512 29fb6b113b2fb969fb04aede4e63bec239297ce3cd49b20a06c656122e5d242e05cc67aa1015847dd4571cac7acca97cd0a3d4109920f88785d098666b0dadd3
- SSDEEP 49152:yAaPXMZlHneKfgVUfcZRMp5tVLGKgB7YR0SESt6:e8YB7YR0SEW6
- TLSH
  T17FA55C02A3FA21F9F0BBD23886664627E5B678452334C6DF037047661F27FE099B9725
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  SOLIDWORKS Corp/eDrawings/netapi32.dll
- Size 423KB
- SHA256 37014d346ac9a3a715cfac404d0c6fbdd0c107f3dabc301a4cf4c643b3bafcc1
- MD5 ebf35e586e43ff8647a3b7867320217d
- SHA1 9c040ce7f680c32a262a8484c383590c794f1588
- SHA512 d7eb47f8fd60d1a64cd59012fc3c31a0fe71df121e5ca05dbca33183397273150f963583cfca6910ba909b8605f9688a1d70b164cc4197666f0a7c9459ca9051
- SSDEEP 12288:hTXOA4wjp0yPUHk36dTa9faPANFrAe7OTooi05t:5XPegl3H9FUUoi
- TLSH
  T1CB94E11A73980876FC7B817988931A42EB76B8025720BADF0350077BAF5B3E5793DB54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32