5f4a1d93217b6ff25c426d38a2aac83cbab46f387805c0aa17fb9c04c6d3dd8d

Sharing

Copy URL Twitter E-mail

General

Target
AFQM_B22705140~AG.7z
Size 146.5MB
Sample260622-qjwsmsct2r
SHA256 5f4a1d93217b6ff25c426d38a2aac83cbab46f387805c0aa17fb9c04c6d3dd8d
MD5 570e0e5ee8e192622a72d1b7e4ebf591
SHA1 7b4ec4fd5bd2c648cb3faffc4b076c99936ce019
SHA512 7f26e02d25fbfc42c65672700ff685018f96d3c68978a35f5ee221e994e74607401c33cafd1c18f946d6df9ad3c354701169c02d600e280f67704e2fa3767ac0
SSDEEP 3145728:K1bsLMNk9HSlJ7YzfIV6/XkJ4GQKknO1H8EDLChI1Tmb:K2LYcSlJ7YzftOAFOtvLC2ts
TLSH
T154783392B7596E8DB56FE9BF324CF48B4E3DDC35D45E825821E6BC42C481323631A293
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  AFQM_B22705140~AG.7z
- Size 146.5MB
- SHA256 5f4a1d93217b6ff25c426d38a2aac83cbab46f387805c0aa17fb9c04c6d3dd8d
- MD5 570e0e5ee8e192622a72d1b7e4ebf591
- SHA1 7b4ec4fd5bd2c648cb3faffc4b076c99936ce019
- SHA512 7f26e02d25fbfc42c65672700ff685018f96d3c68978a35f5ee221e994e74607401c33cafd1c18f946d6df9ad3c354701169c02d600e280f67704e2fa3767ac0
- SSDEEP 3145728:K1bsLMNk9HSlJ7YzfIV6/XkJ4GQKknO1H8EDLChI1Tmb:K2LYcSlJ7YzftOAFOtvLC2ts
- TLSH
  T154783392B7596E8DB56FE9BF324CF48B4E3DDC35D45E825821E6BC42C481323631A293
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  !Read.txt
- Size 1KB
- SHA256 87abf6efbc6c96aabece4f59efdd802629d63aff879f728416b94b65ccb16f21
- MD5 0594966a0292e0f91fb4328c46d6bbbb
- SHA1 26c8431d48643d324efa1aa3897206879338dece
- SHA512 c25141c074251e9ed7fc85f2c60b3e3cad21cfd4c728564405bc095d6861e2a0a70614d493afe89fe6f98183afdb96efb4399c0cadcb8ef1968c7a507cc2d665
- TLSH
  T1F62130553D0052852A63D2D5B663727ADF0C488BC6CA57F67DAC2C3EE717BC1411C146
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  A Few Quick Matches/3d_default.obj
- Size 985B
- SHA256 75f463b41c07b27577802a22be931f1e7d279fc9f89e72c74a7b07b228c9839d
- MD5 41b6cf60647bc95d77dabde627e2a32b
- SHA1 3d08e265704e1787245f57b97a6846b57a516edd
- SHA512 6cb889bd57036c1907cc254afc778aaf6d1903806670c21e21fc1528e3c42c4a1994bcae158fa8b05b22119b610ab03bdcd6d4463303149a62a5f9d29670e22d
- TLSH
  T1E11151F007645250E2BCCCB66C79BBEDC1AF387FEAD498C969E4A37490BFA642450108
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  A Few Quick Matches/audiogroup1.dat
- Size 26.7MB
- SHA256 ff1d3d2e56c0be062382db717e13fd1f0c4531debe4b2f2747bb968094aac3cf
- MD5 293775db99d824e0e51ab44e03cf7c07
- SHA1 60278e9bf4e038dded419e3cbef6aa62702beac8
- SHA512 7e053ef33bbe60b33e81c57be4c73221a60c263ab1cdac819e64856f1bba1f2cdf35f0510b6a8974dc97ff3ca1fa6e280d20d34c45615ea2ad05f8d4c9b7a181
- SSDEEP 393216:vSty+U9SPhaQ+VM+vB0HSDY5b6p7/QEf0+Ce3IbRXxGg7:vSty+UKah9OHSDYO/FpVIbRXxGE
- TLSH
  T1FE576C93F0438900C86B4E398D63AFA146777D2AFF0B571B3044BB196EB33D19A256D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  A Few Quick Matches/audiogroup2.dat
- Size 2.4MB
- SHA256 8acd082748a2f4a0685211d726f48988489eaee3f0df942c95db4826531677c7
- MD5 c3be65e67d078fc0a76039206795059d
- SHA1 5dcabd202a009c0858a4c4c9a475a400a030e538
- SHA512 73e7a457fd002d6eb39f878d3f429a2cfa258a49a78a6cde14287e3f9bef28ba0ab2c4afe38bb7557ea0c6c5a98efb1741d68f9c4f9c0159bda33879e15f9c5a
- SSDEEP 24576:WD4Jv39AE9IDTS85oEWy7TKSN2DBhHdZOc4bPoXav3Rxa+O9qZwPMWbZyKZddaUk:lvNAA6b57W7lDBh2c4fRc9qgMGZjj3k
- TLSH
  T1C9C508C2F142DD10C81A5F3A8D63AEE543337D5AFF5B97163084BB1A79B32C25A35682
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  A Few Quick Matches/audiogroup3.dat
- Size 103.5MB
- SHA256 4fa19a509aed2d9fe711003c023c05ae794e9e62bd250ebc35d27dfdc85de4a7
- MD5 b7f1f14b7ce4791bf95649ee883e7258
- SHA1 30fc2f6557ce85128ad163006a75099675c45a0e
- SHA512 9ba473ed54eb7d830056cdb1502c2a6f4024f8434368a8d66033ea128483d7d6770c3afaaa56863132b91587739772babf9696daa692dffcede0fefd544d62b6
- SSDEEP 3145728:jbVAKlMmfed1KZuyaohq5zndykZWr8r/9UrEuT:bTmdIPaoA5rdyOWo9UrEuT
- TLSH
  T129381263F4D34A09E677C3369ED15D5009EAF84CBC690A1F754ACF94B263300B96A39E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  A Few Quick Matches/data.win
- Size 101.0MB
- SHA256 26c45c0089fb3f3363bd3999773907f7a90ca412ac320b9b839ed6cd6e17b52b
- MD5 b90290eb7ff6372aafbbe062ad3f0be2
- SHA1 0e65e0a169948ac7247e571d4095578e827aa3c3
- SHA512 720eff60fd0be191d208f50ebeee7135c2f2f682361058d07602c29f23c3daed47a103a587dcdcbee94173e715844517354e08d8fac95d4f9d9ad0378050ac2c
- SSDEEP 196608:n0LjLEbcXMjrlAEt+cQD1aPEGhSu2FQB5/tvIXWeBnxu5ySwFDo8VBdHdU8:0LjGcG4BFQvtvDauE3F885Hdp
- TLSH
  T1D63829A22563AFF3C535C53EC895AE5530347F6CB9E05B36A5CCE20A1A31242D98F36D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  A Few Quick Matches/default_afqm_profiles.sav
- Size 568B
- SHA256 9ba76a523c7359e7d9b853cecbc597771cc2761003f69c9e04c7620601ab6bc5
- MD5 398acd285c9aeafd7d68c9e13c7a8f37
- SHA1 871439e7f6309e072e43b1352061eb7d5ccda012
- SHA512 aeefeca5915d55328a5bcba970861d05cd77a2057a8e525e659245650e6f875dfccb057a535c28070b5d653d312736e050411af0fac5a94820bbfc176b837f8b
- TLSH
  T1DFF0DA12C582613CD5D08256D2A974250710705BE8EF087DD191777EB7B6FB68AF184D
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  A Few Quick Matches/default_stickzprofiles.sav
- Size 7KB
- SHA256 172e989a080b11f7bf049c3acff56d9061f353bd9ceda4ce6c6ca298a39837c1
- MD5 f6aacd03a9602cc16a8801c53f358397
- SHA1 590fd20925837368d98bb2eae8cdcef6593ed46c
- SHA512 d87d192ab5b07950dca310b7efff59a1ae08cb897fb5259d55ba45cf2e77de5482c029152b9abb1eeeb5cbd3225dd1a2d7fda33fd415131cb66ae529cb999403
- SSDEEP 48:G+NQwPk0sonECBWSG7HUGjCnesE3akBNmn8FXCJ8NurmnPk07NVouECB4HRwSGUM:GxoBY125sBS1q
- TLSH
  T11DF1DF33475E185CA0BC973C9D5CC811D6C0A39F1C5E2C47767CAA8D4FB32868A99A1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  A Few Quick Matches/gameplay_eureka_0.yytex
- Size 78KB
- SHA256 fd3a9595cb7ab31bc48e2334ec76ae3df62ce280147e8f5a157809f74ad3e5ef
- MD5 e00a9e7508bfcc32f6e8e2013c60dd98
- SHA1 423c4b24d3e73e6a20e6a50027dd3d255043c3b7
- SHA512 40cc380aa97207d05ffe4e9435dc7143f0e4b471b94bd0fc145be36eaddc323f8b1bbecd4b930af0784014494afb5280e33c3e52d31f0c03849a4521ad0f757a
- SSDEEP 1536:MmdJUMsCHM7mDEtaJVUcnYNp8AnfGWVNttPOKr9conhEjtNIP6r10Jlf0srI93Q:MNr7saaLIXnfJV9OKhcLtRpZQ
- TLSH
  T1557302BC55135035E481647F73880E76C685B3F16BD4DEA529C10C2EBE50EB9D2EBAE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  A Few Quick Matches/gameplay_knockt_0.yytex
- Size 86KB
- SHA256 1688444e4d9031e53fef408a55a7b8c382a98d23e4501ceb88ff1d5c45e24083
- MD5 5eef37399d6dae3b94ed0899ba49f933
- SHA1 be76f709a73efb5bdd6e30e046d7bcb4de012ed9
- SHA512 f9038bfe87c252df0f7e905fadb9dda608b535c6c4875b6e46fa97173d5b576d4989f836a7f66bd7fcd889695426852ccf766690dbf3753e0a62c169a29b2426
- SSDEEP 1536:LGkDn4f3h11FDiHU95YENd0mesF8D6fq121x5BbKJUznpl1GYz7IRonJQA3a5fG:LfDm2HoNNd0PsFsExKJKf1XHCoJQUMu
- TLSH
  T15183125AC64215D1B97143F20BC0BBE94519DB343E0C0593BE78A67AA4BE91AF33970E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  A Few Quick Matches/gameplay_ninja_0.yytex
- Size 57KB
- SHA256 09e29070902494f89a987f88ec0cd56134cc503fb1314546ccc7e4060f7659d9
- MD5 367a36c2f70f7d233a8e5c4d87942cab
- SHA1 f798fc1383d7eba9abf54d4bf2a18fb299d5be3a
- SHA512 e92b9f3a4c281b2221ebd9bb43822d81b9de2f505b7d243470134fb9edafd06f4bff7dca74beed86aba4033e78cda4ddb7bb2727ab1c870fd843be20db552798
- SSDEEP 1536:lgmY80Gcdy7kvh2G0MsFYQjSMGfZzWHXKoh2f7:7cDp2ZKQ3gx7
- TLSH
  T1AA4302DA884D4384E51E38B10D9880EF7392B5DB3EDAF6969D20BB498C95385F18F34D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  A Few Quick Matches/gameplay_rend_0.yytex
- Size 113KB
- SHA256 e948d04dd8b16db71cb83aae0a468fbc1ce445bd60de03352ae53e81bdfc0add
- MD5 746965ad7ddcdc2a9f6e9444423059c5
- SHA1 3d1dd75a61ca64c7bc062b8a26af60a52a4058e3
- SHA512 71b6815c9fa52fc5bd09c7f7a2c9ef30469c31990c4a7854517a92ff304e978dabc4ead148a2a8d7e787131ee98119dcaa2603cd06597d13e2e67fce675443d9
- SSDEEP 1536:TvE9KJC9LxyRV5USLpbiJ1Wsz+iyixcUrR6xdaEFU1bcVnG3wiVdqqpn5PyZJZZ:TwzFyeJrVyQrV6xdccVKTVtPyNZ
- TLSH
  T112B3123A2B76554CD79FF4F2E901067B781246E723603074BD4AE92C9CB6868EF28752
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  A Few Quick Matches/gameplay_sarissae_0.yytex
- Size 142KB
- SHA256 b6f77a315cfdaa242237a93e04737e3d36609e99ff042341385d9613291bb1f6
- MD5 323629ee50e90cc8a356667a7db96371
- SHA1 b88aeaf4a896831c848c846e2576cd999496bbc4
- SHA512 da82ab9ced442640339801076f708180af11f28ee5a4a8d2b59f5c6bd30d245afd4926cf460e82acd11ef178e78169dc30afac945c7d255e8fa85a81fed16e1e
- SSDEEP 3072:y1Ozw/GfdsAiVDcz3etb9pOzoSahu6UdO/VmUa5E+DPgNbsvKVNsr:yQycytpgixa5EBdAK+
- TLSH
  T159E312DE88F978E246164FB6870243A11877D9253C28529D0F76DE3FE54C932C2A1BBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  A Few Quick Matches/options.ini
- Size 89B
- SHA256 1b26a19ba6e77cce99b588d7b7a381b3ad63547a26903d6b1d9f5688990cdb5f
- MD5 e9b72666f659fde0c524d3d75c3ecb25
- SHA1 675ef3785584080470e4acab49b1299b78b735f9
- SHA512 c8d0a3d41f2910d8241d921bb1bea4c0adbf0a4f3cc1b791c139be26fb9bba9f4c8e281346f64f5211043ceaaa6bbfba26085a2ae5144465895a47d18145ce0a
- TLSH
  T1B6B0126118348AA88534B0543146619517C3531A4002410B5411406E1B81933540D066
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  A Few Quick Matches/stages/arena.obj
- Size 173KB
- SHA256 1ca6e156a48a14dceb7cadd1370e2757e4a48fb242405d480f1c1821344090a7
- MD5 93c083b19e1ea26fc4f6824bbf71dfd9
- SHA1 d2fa99ca8ccbcdaebefb2bdd60002d786319f260
- SHA512 ff9d93d5be47eed9b5729d274dcac907aeb14bc8a8976470234076e94e2f52f763e25264dd79a5f594640682742b6fe14f5d28667e768c2e50b9d9666b5022b2
- SSDEEP 1536:HIDR4XL7B47kagLiuafD3JOgRKpwyfMO8z4+RILphRtTwgbMRjKt7bpLnh0J6Ykv:hvtN5
- TLSH
  T11004A5F4BBA883B5DBBDCBF5C8160B8DDA4A09272B41D584CEA40DF0A61FB5F65C5408
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Checks computer location settings

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32