fdf62cca7e7b7b73486321b0b29260cde2de3b283d87febec10f88c87a31f646

Sharing

Copy URL Twitter E-mail

General

Target
MCWinMailAll.zip
Size 12.3MB
Sample260622-tyez8aes8p
SHA256 fdf62cca7e7b7b73486321b0b29260cde2de3b283d87febec10f88c87a31f646
MD5 268188701cfd8c256b1fd50aefc904ca
SHA1 32f90dd064f0fe47e783e6dae00e9c2ab2063be7
SHA512 fdd5f7d98e37b7d4d4a9ff4ed7e43e425fe890d44e75786546477d207b14d44efd29772ea7876466a60261943f4c8768c87a023c2865f33b9f788fafe0142ef6
SSDEEP 393216:VUqSGQxjPEbajDclAZRV0yVG2b22crYVlX:WqSGQxjPxcKVLjX
TLSH
T111D633773AF58E8797A66234A26CB543490091C5834CD5A1F3A180E7DB458BC3FAECDB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  CommonLogin64.dll
- Size 2.1MB
- SHA256 bc7da6350d5a5d98ce29623409c5dc24bc467c1406a19f8909ca2213ed1fe1d8
- MD5 fe380f33acd98dd4c7267e454e80880a
- SHA1 cd67d7edc9219903b473baf3daa65d5279620546
- SHA512 a57374e1d0811f5d7e48ac5c1eaff8e57c725eb897ccffa88cc4bf44460e81b6615c6da4c836ea2ae48831281c1600e47c029314ecf36801b4abe2609af594bf
- SSDEEP 49152:6OsvcW7+s4h2JBdlRHidawRFPhDpIi7ymTgwNLEdb+cLqcQ5Ew8gh/SmiCTvG0nD:Ikaq95Ewt92XTcD
- TLSH
  T1A2A58E077BB900A9D167D13C89575A0AE2B278550B70ABCF02A063AF5F377E14DBE325
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  YXCalendar.exe
- Size 3.1MB
- SHA256 c7df57c6addf8aa38a619ac38c782733d5bc594d079e88ba5aec8cad148388c4
- MD5 ffa4b02695700d8dfe861944bc9894a1
- SHA1 da131d65eaceae504ee9b4b7dcbf5ef5c5b879bf
- SHA512 62afde3b519a62602bd35910e48b8d63448dbf9a66f38111f1787ee92184e83442ea111fe1bd29ef9cd9565408f16d9408130f08c05df3420798a1d01ffc5dd4
- SSDEEP 49152:SGSfTGVq661KEHWWc4RDrSiXQEUSzRKwS0PMyEsmmYuZ9l7LCLG:sTKcbWMRdS0PMZmYuvl7LCLG
- TLSH
  T118E55B676EE400E9D123C035842BD97AE2B2BC570732CACF0164F65E8E276D75E77622
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

bootkit persistence adware ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral3 behavioral4
- Target
  api-ms-win-crt-runtime-l1-1-0.dll
- Size 24KB
- SHA256 d0bde181dea08ab14d97ac3cec64eb6237ffbf158f8f8ef4f0ccb713546c0159
- MD5 db21b81f63c7e6a653e7436f999a102c
- SHA1 c550e485ff730d05ea620052d50e1488a1924f1e
- SHA512 b3b6c7472bc2eef9d15066e2dc282c4e020a7eb466a09c9bc85cf138b5e2c4dc3705b36da6f46a43362a389309c30730526e0cce83be16a0baed0286cd978159
- SSDEEP 192:h3UW9MPrpJhhf4AN5/Ki9WBhWtcUyfUlHDBQABJvar/uuOiqnajBH0:hUZr7DWBhWLDBRJzillU
- TLSH
  T16FB2C6839BE82F17E5972B3312F9D7CB2E3A638215104679C857F08939C3785BE5760A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  curlnet64.dll
- Size 2.3MB
- SHA256 32575a73822ce645d9a26a3db009286f5a3d7d85099d5c5e3189ef939954bb07
- MD5 c5237a3a64ad5fe3d118ac7f066bff1c
- SHA1 60dfe75c0227ff13cfbe2865fe703fed6ade4ddd
- SHA512 56c0dca4bb76c665eb4e7bb1d13028a2934ad76fd585b626938c9337f1be6056d059502216d3251d2de9de35a534ab010c5c7b0320513b7a8c4f6097c428bdc6
- SSDEEP 49152:LwwDQ6bX3ttDMZ5BD0fybv3W6MjYNIZUiakQ8Oh5PScufTRTLP3irf:zJbWBQNdDL1rij
- TLSH
  T100B58C56A7A804F5D9B7C27CC9538617D7F2B8151370ABDF06A08B791F23BE2263A701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  msvcp110.dll
- Size 645KB
- SHA256 27f394ae01d12f851f1dee3632dee3c5afa1d267f7a96321d35fd43105b035ad
- MD5 7caa1b97a3311eb5a695e3c9028616e7
- SHA1 2a94c1cecfb957195fcbbf1c59827a12025b5615
- SHA512 8818af4d4b1de913aae5cb7168dcec575eabc863852315e090245e887ef9036c81aabaf9dff6dee98d4ce3b6e5e5fc7819eccf717a1d0a62dc0df6f85b6feeb8
- SSDEEP 12288:akhiz9iVQi6mpiyMATITfluR3G1YdpTzYJQIbRdJN2EKZm+DWodEEt2L:WaQeIJN2EKZm+DWodEEt2L
- TLSH
  T17FE44C13BB150AB1E152D378A0D78741D7F1BC498822F30752EBE27D6F67391AA6B360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8 behavioral9
- Target
  msvcp140.dll
- Size 559KB
- SHA256 1e57a6df9e3742e31a1c6d9bff81ebeeae8a7de3b45a26e5079d5e1cce54cd98
- MD5 c3d497b0afef4bd7e09c7559e1c75b05
- SHA1 295998a6455cc230da9517408f59569ea4ed7b02
- SHA512 d5c62fdac7c5ee6b2f84b9bc446d5b10ad1a019e29c653cfdea4d13d01072fdf8da6005ad4817044a86bc664d1644b98a86f31c151a3418be53eb47c1cfae386
- SSDEEP 12288:mPeu+VwM4PRpJOc8hdGE0bphVSvefIJQEKZm+jWodEEVwDaM:sqwpzSFJQEKZm+jWodEEq9
- TLSH
  T1BBC40923B75906A0E195E3B8A1834316D7F0BC4A8322A3C752FBD69D2F673D5673B250
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11
- Target
  msvcr110.dll
- Size 829KB
- SHA256 ae996edb9b050677c4f82d56092efdc75f0addc97a14e2c46753e2db3f6bd732
- MD5 7c3b449f661d99a9b1033a14033d2987
- SHA1 6c8c572e736bc53d1b5a608d3d9f697b1bb261da
- SHA512 a58783f50176e97284861860628cc930a613168be70411fabafbe6970dcccb8698a6d033cfc94edf415093e51f3d6a4b1ee0f38cc81254bdccb7edfa2e4db4f8
- SSDEEP 24576:I+9BbHqWVFlB7s2ncm9NBrqWJgS0wzsYmyy6OQ:z9d7M3nS0wV
- TLSH
  T1BE059D5973A505F9E477D236C9578617F3F2B80A1634976F02E08AAD2F237609A2F313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  vcruntime140.dll
- Size 107KB
- SHA256 2aebc4e4ca7645188d12950ca68b39f71ebd86da4228419800c1b1a3754f3130
- MD5 ded0fb624c202e3595551256e3bc0ba2
- SHA1 97c0c52f69fe76c9f1469f3cef78e12e598ad325
- SHA512 e7b5b9e7898361254903f1dd8b6f4a49fc0854460a427f4249e9e5e1b95c116a7be61e9ec43f02f70a56ad5ad3ce5205d748525cb40829cc49dd835b605c9fef
- SSDEEP 3072:yD7mylIhkoQpdK9H9YOecbKVfT8KuKnK/:uiylZoQwH93ecbKZ57K/
- TLSH
  T101B37C5A766442B7D4ABC274C1E24A1BEB70B880977093CF03B185A65F63BF05E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  vcruntime140_1.dll
- Size 49KB
- SHA256 fd1cc0c1287caf736c7e1e4d9aee80fd74cfdfa52563ddd126c03f45542d45b6
- MD5 f498619721756332ef731f1b72b7f29e
- SHA1 5beb1e7f35c33bf636cf1a336b3a02a6f02b0394
- SHA512 ce98577b8783a6b0305ede64811b6a8e094a237589530cb0cbc3af3530d5503f3bf5abaa2b2abcf38f2d3588d5e54f2a322ff78ea8296f0327627eea0da5a8cd
- SSDEEP 768:PECm5yhUcwrHY/ntTxT6ovF7Iyw4Bl9ziKxnVbgvqxN5UNK/Y/+2d:bOHc16opIyw4B3ziKxnKvKN5UNK/W
- TLSH
  T1D1336C95137C9152E4DF897490D29F37EE34F9A1B751868F06A0C1692FA23E0FB3931A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16 behavioral17
- Target
  vtksqlite-9.6.dll
- Size 1.1MB
- SHA256 1859950b3f410ae37bf115ab107917f6af6313a598f76ddbb0225d9cc85518a5
- MD5 c3d6b73e54ff4efd29651e46f751fe5b
- SHA1 a4358deca3180c3864cd4030d9ac3eea5634a7b3
- SHA512 4f290733e6ec81fdfac686f142a02043f187739599c61b5848cbcf16929a2efafe0f479898b1ea971a486a4849c6958ae2931f3aa4c6e4e392b76c934291158e
- SSDEEP 24576:ZxOmhbPt4M/eTGtckjzy7Buz8NQksDi31:Gys6ki8Q
- TLSH
  T117457D47B3B801ADD0A7C178C927570BEBB1744513649BEB469086AE6F23FE116BE324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  x64/LYSDK2.dll
- Size 3.1MB
- SHA256 a30f0643c7c07a9e014cc5de5d5cf9c03489b61660bd3783efb030f7c52dfe6a
- MD5 91e9b61aeb427f56a870f7b1d781fc9a
- SHA1 b44dccc5f1e6f4302342f236c8f2d71e75bd05fc
- SHA512 0bbdffef67d6081d71d13e332a2c101a25b0fc2a7b7c4e919144bf8e6beafd4ad8961c41e075f310d6b42ecd8a09d626c0ba524a8c0f93a5f3b528e02e650ef7
- SSDEEP 49152:CcpLT4K17o1fjN+tHhJC8otbMtv6nvEISYOCzU4Fcr04OTbJUN9YrrzbwpSGvXGx:xtA1fjAJC8uwv6BQ4erkLajXGx
- TLSH
  T1CDE56C17A29401A8D0E6C1BA8E6B9D43DBB034060371D7DF0A91C9935F7BBE15ABF712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  x64/LsfSdk.dll
- Size 6.3MB
- SHA256 aa68dac66a9c0d815bbe44644cbd60ec0c5a1d3ecdc56b7d8b1a2a9855398026
- MD5 f05116adc796497512385c8475ae4a8c
- SHA1 81ef3c0e78550afdcc02a97ab6ae9d4eeb21dcba
- SHA512 f5a9183043ef7b59e07e8ed71a61c18bd30fed4616f5525bc97e36c8a6bf1ea0b7678e75f042edc1e61cb114efe8c7073891f8229568c67b3aeca4adb573b825
- SSDEEP 98304:Q8GJjCZ1K13Wl1TwVCWvt9XX40TlV6q3zK7tixbnCXbGS:Qd9YBWvzX40TlV6q3zK7tYiaS
- TLSH
  T13166390AEBF980E0C4B6E139CA57961BFAB27851573487CB52918B0B1F337E1993E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  x64/WebView2Loader.dll
- Size 135KB
- SHA256 ede42f3392c3573ac8660263072c7fd50c0e1605bf9fabed05c10b9d35e214bc
- MD5 cb57ee3dacb20c34ae3296aaad8f128b
- SHA1 b7f1b8e2f0bcdc1376ff4c3121c95f41f9696a56
- SHA512 a40b231b41be8863389318ea6c42f2bec6bd57d1519cab74f9f80eefe143df3734179de7c2995f16e32955786e3ee03a6a023f4d5037b82793b4c95adac5f2f9
- SSDEEP 3072:6PzSYWDiiK+shdkt7E86qWBgbFCAg3esIDKEtn2C85N1dymx7:3DicWdCD65BWFCEt0p
- TLSH
  T140D35B5B73E5007FE1678274C4A34A19E772B8501BA09BDF03A802691F677D1AE3EB71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral24 behavioral25

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Writes to the Master Boot Record (MBR)

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25