9e3031df74a81bddff8fd973d137a2505c87cee07b0a112cb84709d44f098968

Sharing

Copy URL Twitter E-mail

General

Target
MacroGamer_v275_Source.zip
Size 142KB
Sample260622-ysbstsgt5x
SHA256 9e3031df74a81bddff8fd973d137a2505c87cee07b0a112cb84709d44f098968
MD5 da89d18de41449fab464d6399aa60d7f
SHA1 8056ad22af11affdc1e9911394900c04d8378a1f
SHA512 3fa8202cb495fce447e96c19b0a076e656b3ad65cdd8e110fb1af370f76be982858e35149b9ede8e462ef6d588631167a7890dad5802034e03f405e14e3ccee9
SSDEEP 3072:ltW65EkLxMhk8mfCVi6hV6g1+nC+fkVqoRgmcU79zMi61PBUvn59/N+K8HBf:ltOcxI5VnV6g1L+fkbRH3WiTx98Kg
TLSH
T1B9E312B4967E1C40E19B55B2AF1043712FEA17E102A6D4CD903046F9BBCB3E479BB85E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  MacroGamer_v275_Source.zip
- Size 142KB
- SHA256 9e3031df74a81bddff8fd973d137a2505c87cee07b0a112cb84709d44f098968
- MD5 da89d18de41449fab464d6399aa60d7f
- SHA1 8056ad22af11affdc1e9911394900c04d8378a1f
- SHA512 3fa8202cb495fce447e96c19b0a076e656b3ad65cdd8e110fb1af370f76be982858e35149b9ede8e462ef6d588631167a7890dad5802034e03f405e14e3ccee9
- SSDEEP 3072:ltW65EkLxMhk8mfCVi6hV6g1+nC+fkVqoRgmcU79zMi61PBUvn59/N+K8HBf:ltOcxI5VnV6g1L+fkbRH3WiTx98Kg
- TLSH
  T1B9E312B4967E1C40E19B55B2AF1043712FEA17E102A6D4CD903046F9BBCB3E479BB85E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  MacroGamer.au3
- Size 108KB
- SHA256 81d14495e5ab13d3aec1c25832843cbd880b75291e9b3020f617c72469eaeca0
- MD5 04eede6b9daef8a704fe67ab529bced1
- SHA1 69d8a805ebda6a72067b3474ba921b8969f234a4
- SHA512 213c4b27f6ef4579d1e94d51b8cfe75f77039c5831cb62d4606a62f1649d00e55ce4bbb328cb0361f942b2cef17a47844fe767ae619f6cb0eaecfe124ce01a5a
- SSDEEP 1536:qNnfPs/CyZHF1mgtjXAbX9FE3gQKOlsiS0NEN3NCOtTrq:+7yZHF1mcLAbsQclgDti
- TLSH
  T156B3C521B22D4C56F6831903547B890EFF0F8D16F9317287B4394DAC22797B4629AEDB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  MacrosDisabled.wav
- Size 297KB
- SHA256 155f4a862140a5438c7f32be38551e7a20c761adc5d350ecd503a809b1ef851a
- MD5 79c03707bd6c4348c8ba135f55854a15
- SHA1 f3e84d947ab067477c3d139c4245f4ab5ea1d2ac
- SHA512 f228cb66ef166591c82edf3b813c1efb3469cdb9eab3d09d460482873ba594c7cd2c8133203db244e4e81ba4b790d23c3d8df043251a50d33703087afe1bc286
- SSDEEP 3072:DM2tTD8888lSEn8888E8888kbrn8888/8s8888sK8888U88888sa8888LgF8888H:D1tf8888lSE/brclta8888LTlnVs
- TLSH
  T1DC548373F9CF8012C1438430AEB4AE3514765A58D9770530F9BEB689D2CBBD129CFA98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  MacrosEnabled.wav
- Size 273KB
- SHA256 3365cd94173df80024154ae4c3f6602758b0bf7436cd236df0aba5a9f44bc948
- MD5 491c8fc76fccb9fd5f5217b8d4a7a976
- SHA1 c67bf9ffef8ee539c0d2b2853901b375bb55dd0e
- SHA512 135d76cd298179832187d5bb2258683997d31a8cdd2012ae3f3dc5c7629e1cd557c0d6527cf03fc03a4bc624481296b3d9a333ad10f41bacf1fb922ab2fe2d09
- SSDEEP 3072:RM2tTD8888lSE0fsv8888X8888kMk6g8888c1t8888X888838888c1NE8888k88H:R1tf8888lSEck8888li1N8ndSl
- TLSH
  T19E546173F5CF8112C1438430AEB46E3960B55958D9770534BABEB789D3CBB9028CFA98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  RecordingStarted.wav
- Size 269KB
- SHA256 9653a694a897aaafef12d3cc5a47389ba2a2966eb119b3009d6cfb64163910bb
- MD5 d741e763eda5cba9eba261e3098b0420
- SHA1 ace7d5fecf8058c48a5eeca46b9c9d5c22eb482f
- SHA512 d48bf5c80efcba6afa5888b29efeb6c731b2390f5dd08ec1f87bfe3b73178b8145c7944edf4cc9a998c7240b41de4291e3986738cd106610d890355862299fd9
- SSDEEP 6144:mnfv8888X888838888k8888i8888fVl8888prG8888i888838888F2:mnH8888X888838888X8888f/8888Ft8d
- TLSH
  T1B444B4A3F8DF4112C2878431EEF87E34647A1558D5770130B9BDB699D2CBB9029CFA89
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  RecordingStopped.wav
- Size 290KB
- SHA256 dd624a405a3bd4bd08c5480b9766d4415cc8d745a64aa4e8a4b9283003429a17
- MD5 c5eee3f8239dbd49a849702566eaee99
- SHA1 79cabe82f9724732752ae9f7416f3eeb2e048f89
- SHA512 425cf8528501f79d601242cb8eb593c70e1d33cb30a8a0c9e06d41efee1388f2123d4fa159b4a3873b246a18e43a1c5184f9f2f90313b5f12b99772b3728df7f
- SSDEEP 3072:xa888838888E88889enfnv8888E18888ggHnaLv8888X88888vl8888C58888D7E:inf8ar8888cvgtxH3O
- TLSH
  T15D549293E7DEA066F14654307F74BEBF107D1C54D8360C21AEED7E84B38BA501C9A9A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  gmerico.ico
- Size 2KB
- SHA256 3a42398beeb367206df79cdc96ed052c3c6f1d62ac905b7e33f71bdbe413527f
- MD5 5dcafcf4e8260357f57cefcc01f0c0f2
- SHA1 cf013d7ccdfd062e4c2be384b0d3abe6054c65f7
- SHA512 c661c5ff9e31afe4d0b59e46cc765479d50a0f139489311817507db41a3f6e867fd57167e2599f142a8652f1e213ba67d0eaf0e3c6f4ee26be41b527c6995b04
- TLSH
  T14851DFB3354E8CEAD14726345C51CAD87221BDAB8C283C3AB4E737AE54346D08D8E6E0
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  help.chm
- Size 21KB
- SHA256 7e72d0c29d113581a58561d2e1db812c92d239b8e32cecf9d5f3a36662bab0d6
- MD5 b3259fa1e1d5f433bbc5348bd17fea8b
- SHA1 f4c2fdc6295c9c103ce4a417ac80a04a72c9da57
- SHA512 c04666982203ce477514c04a46825ba6651c2e2f5f3ca1241b3589073b318954ac88753498d223582f411069b16ea666285f8c333dcb743a5c124eb957305527
- SSDEEP 384:DU/OgY26Q97UYnmC+7qm2niz932mlsSYBPcz1YoaWc9Ze7uBw6:DUmvuUjdyizs3BPi3s9lBw6
- TLSH
  T142A2BFA9B2509108C40B5DB36EB9E956A7321E203DF62549F27C626D05FBBCC0F6149B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  kh.dll
- Size 4KB
- SHA256 ab05f3533dbcd3d829e984e33110c7c568cbd64bd1cf9dfa3408b6315d1f668f
- MD5 3908212a9e2bf9839e765655a31a8001
- SHA1 fb0ba65176aa3bbe1558530c68e8fa096b9c0a7a
- SHA512 80e51096f684367a7274da5a418550aec5b9e5506604a0b424b90efa432bb40cd5e7cdd49bc474bd9caf4e572b00704717f36516d8cd3e80d27087792effe73a
- SSDEEP 48:6mh9GMCc917rXV2fMrXUEaMrDFSGsh1MluhewNgZ+6:F17zV2fMXrZSGshOuhlNgI6
- TLSH
  T10B91415FA3424557C0CC17FAA95B3A7B122B4DB43AE601179CF7950B382B3935E35B05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  mgconfig.dat
- Size 98B
- SHA256 06fc4aeba8af535656c8d3d4d6804e02f73348edf61d91f325a7fa4ec58ce449
- MD5 604e297e623edc17ac727f89796c2e2a
- SHA1 22aaec3d159df072817b698b1661d97a77645aa5
- SHA512 36365db77086d3e42602666fe0b6b1df7252c8480b5e29314b541485dc8ec89e94651e7857c150b978f56dd1112e134bc91d4360ed631e913883e7868265f419
- TLSH
  T15EB0024F710DD51B42310720A90567507415170D912DD554F3A7D3959C984D16404176
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  profile.mgp
- Size 149B
- SHA256 d9a7f89b0a5e9c5cff8bf2073e9af520347930d8de7db73fd9619bae7cf68e49
- MD5 c37c104cb195d1667874c32e2c1ed9ea
- SHA1 29ed44d86255f792ec3ae37446ca1c81d0212bff
- SHA512 59c1c24e4a9a599257ca24c968c2420b4dff8223e287941c5bc6345e91dd017086da0ff9f1e57cf3b90d013be783ddba44c7f9744ddfb0245dd40f62fca9753c
- TLSH
  T13EC0483EC437EAB530AD00D800A8CF04AF03808300A720702C027FDB3C13510EC6F2A6
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  scancodes.dat
- Size 2KB
- SHA256 4c2f8d3dec39671648aa256bfcd220e9f1efccb644309f17e5535151ad7c5dfa
- MD5 f34e92039e140abfee02b4429d0c8390
- SHA1 7851f43a016404d14cadfa1b452d2ec57a23fd4d
- SHA512 2b6bc206699534167be34105f2af271cf53dd15ec3080889e9fc016dadae70c525155a4de66366c0edf0fb65a8eba05b0fd06bdc0237bf517045a016ad21325b
- TLSH
  T125415551E99D16C1EA737292BFB24F110C6AA30A104E3AA337A57F566D80636EA0703C
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral23 behavioral24

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Drops desktop.ini file(s)

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24