General

  • Target
    win7 thing.zip
  • Size 163.1MB
  • Sample260622-e7phpagz3m
  • SHA256 f8804fd771380aec26d5b240a056c7012f727bb6dd5692e8722fecd0487bc41d
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Language
  • ps1

Source
URLs
  • exe.dropper

    https://nodejs.org/dist/v20.11.1/node-v20.11.1-win-x64.zip

Targets

    • Target
      VideoDigitizer-win32-x64/resources/app/node/node_modules/npm/node_modules/cli-columns/test.js
    • Size 2KB
    • SHA256 1fcd21672c20b15775a1070d20c84e4382431144769ac6acfe7a20fac00e3972
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    • Target
      VideoDigitizer-win32-x64/resources/app/node/node_modules/npm/node_modules/cli-table3/index.js
    • Size 40B
    • SHA256 0fe175d9abebf8107d8010ca639651be92305caf276e9f4e92089d8f30d6e74c
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      VideoDigitizer-win32-x64/resources/app/node/node_modules/npm/node_modules/cli-table3/src/cell.js
    • Size 13KB
    • SHA256 8bdb0d3d7627ceb359297bfa480740ce188a3c4fd96d75388077ddd346a22e20
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      VideoDigitizer-win32-x64/resources/app/node/node_modules/npm/node_modules/cli-table3/src/debug.js
    • Size 492B
    • SHA256 7a39be87afc979e77d0f3cc7c6f89a7e50bae22eb51e4c2afd4ca3ce18da5802
    • MD5 SHA1 SHA512 TLSH
    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Target
      VideoDigitizer-win32-x64/resources/app/node/node_modules/npm/node_modules/cli-table3/src/layout-manager.js
    • Size 7KB
    • SHA256 28f4ec2d99f1b65598f7d54f0203b3cbfe8d88910f2578d37b31ef8950a34adf
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      VideoDigitizer-win32-x64/resources/app/node/node_modules/npm/node_modules/cli-table3/src/table.js
    • Size 2KB
    • SHA256 b0a4ab223ae8d6d2519c2d88ccc3690322fa44b5912682642574369f153bbe50
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    • Target
      VideoDigitizer-win32-x64/resources/app/node/node_modules/npm/node_modules/cli-table3/src/utils.js
    • Size 8KB
    • SHA256 411120b1d3a208d9d9cf5f17596bd56c8078e45d32ccde5482ab7e083df9cccf
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      VideoDigitizer-win32-x64/resources/app/node/node_modules/npm/node_modules/clone/clone.js
    • Size 4KB
    • SHA256 33604bce25534f617109524eaded2441daf5d414c50a476055383488fe86226f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      VideoDigitizer-win32-x64/resources/app/node/node_modules/npm/node_modules/cmd-shim/lib/index.js
    • Size 7KB
    • SHA256 06a21f598d23f9db4e5f0a0c9744e6e7aad49fde28f003582bce0ceaffe95884
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      VideoDigitizer-win32-x64/resources/app/node/node_modules/npm/node_modules/cmd-shim/lib/to-batch-syntax.js
    • Size 1KB
    • SHA256 e39a03dac6e5e31c6c4bb58fab2c23e8aeeaacd53e0b8c63e742fe7f4ef476ec
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    • Target
      VideoDigitizer-win32-x64/resources/app/node/node_modules/npm/node_modules/color-convert/conversions.js
    • Size 17KB
    • SHA256 09b482d6ce3dee98c2a050dbd807ab0294255631633255d540ccc74d5df6f866
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      VideoDigitizer-win32-x64/resources/app/node/node_modules/npm/node_modules/color-convert/index.js
    • Size 1KB
    • SHA256 4214b3b891f981db09782bbe5f75c6f7083e1c07af107c009e508ad17971c1fa
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    • Target
      VideoDigitizer-win32-x64/resources/app/node/node_modules/npm/node_modules/color-convert/route.js
    • Size 2KB
    • SHA256 7d121be005cc2df33cbddaeedc0060e231201c9d32ced8ca57880844d066408b
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    • Target
      VideoDigitizer-win32-x64/resources/app/node/node_modules/npm/node_modules/minipass-fetch/lib/abort-error.js
    • Size 379B
    • SHA256 d1da6b9320f1a57e2f6e64c0648a6b7595b8a534b0a5ec416c83d37435b2da90
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    • Target
      VideoDigitizer-win32-x64/resources/app/node/node_modules/npm/node_modules/minipass-fetch/lib/blob.js
    • Size 2KB
    • SHA256 a72620cf7448aa71983bed8b2035953065c92dda076c3ca62274ae8666fd607b
    • MD5 SHA1 SHA512 TLSH
    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Target
      VideoDigitizer-win32-x64/resources/app/node/node_modules/npm/node_modules/minipass-fetch/lib/body.js
    • Size 10KB
    • SHA256 3259348744f25b809313c88655af632161da8b3f7fb5023aed41ce5fce89c432
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10

MITRE ATT&CK Enterprise v16

Tasks

static1

Score
10/10

behavioral1

execution
Score
3/10

behavioral2

execution
Score
3/10

behavioral3

execution
Score
3/10

behavioral4

execution
Score
3/10

behavioral5

execution
Score
3/10

behavioral6

execution
Score
3/10

behavioral7

execution
Score
3/10

behavioral8

adwareexecutionpersistenceransomwarespyware
Score
8/10

behavioral9

execution
Score
3/10

behavioral10

execution
Score
3/10

behavioral11

execution
Score
3/10

behavioral12

execution
Score
3/10

behavioral13

execution
Score
3/10

behavioral14

execution
Score
3/10

behavioral15

execution
Score
3/10

behavioral16

execution
Score
3/10

behavioral17

execution
Score
3/10

behavioral18

execution
Score
3/10

behavioral19

execution
Score
3/10

behavioral20

execution
Score
3/10

behavioral21

execution
Score
3/10

behavioral22

execution
Score
3/10

behavioral23

execution
Score
3/10

behavioral24

execution
Score
3/10

behavioral25

execution
Score
3/10

behavioral26

execution
Score
3/10

behavioral27

execution
Score
3/10

behavioral28

execution
Score
3/10

behavioral29

execution
Score
3/10

behavioral30

adwareexecutionpersistenceransomwarespyware
Score
8/10

behavioral31

execution
Score
3/10

behavioral32

execution
Score
3/10