1b5f0dbbf5644aeae4004f7f4b47b9fdd03c5a0885ab61d746cb6b72fe962407

Sharing

Copy URL Twitter E-mail

General

Target
electronwmd-0.5.2-1.5.3-win_x64.exe
Size 96.6MB
Sample260623-erv1jaas2j
SHA256 1b5f0dbbf5644aeae4004f7f4b47b9fdd03c5a0885ab61d746cb6b72fe962407
MD5 00e22c17c8e1e528f7e61822989781bc
SHA1 c3235c928da2e5947a8223c867c2bf489abd2c61
SHA512 2be7b56261bdd694842d5d63ec891bea23d319aa8bf12f948578eb526f243af0fddfb9c58bd3494cae56d53d6c59601330e22c8179e337fcbd5f7f2b57de906f
SSDEEP 1572864:vfpimVaaCV+84BkbgIm9sK/Wz5B8q0gBdDfn8S4y1VibrSS9ae+qewOLegHtghkU:vfpLCw8jkIm9A5H0gBSSVabrZ9av9bLU
TLSH
T1CB28334262F1D125E0BB5A34E434BAF10A7ABE70DB39904F33483D1EBDB1655B92A317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  electronwmd-0.5.2-1.5.3-win_x64.exe
- Size 96.6MB
- SHA256 1b5f0dbbf5644aeae4004f7f4b47b9fdd03c5a0885ab61d746cb6b72fe962407
- MD5 00e22c17c8e1e528f7e61822989781bc
- SHA1 c3235c928da2e5947a8223c867c2bf489abd2c61
- SHA512 2be7b56261bdd694842d5d63ec891bea23d319aa8bf12f948578eb526f243af0fddfb9c58bd3494cae56d53d6c59601330e22c8179e337fcbd5f7f2b57de906f
- SSDEEP 1572864:vfpimVaaCV+84BkbgIm9sK/Wz5B8q0gBdDfn8S4y1VibrSS9ae+qewOLegHtghkU:vfpLCw8jkIm9A5H0gBSSVabrZ9av9bLU
- TLSH
  T1CB28334262F1D125E0BB5A34E434BAF10A7ABE70DB39904F33483D1EBDB1655B92A317
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery ransomware
- Renames multiple (351) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  resources/app/node_modules/conf/node_modules/ajv/dist/refs/jtd-schema.js
- Size 2KB
- SHA256 ed529445bf027885182bbed71e5458baecec2d356a788b636ed9f0c7cdaccd92
- MD5 e19b5c660215e901f84751cfcd14307e
- SHA1 74cfbdab8bb7249b23dd7bc6a227a53109de14d4
- SHA512 abb70e69dee2332e459f4bcb40dd34bc8c5824d87ffbd86b13fd2b5ed1098f24022d90aa8fe94610596be0c2c5aba41b9fc7b758c10009c10ea94ee0e0fc406d
- TLSH
  T15A511616E4B96C2201E2A0E504CF4106E47453976D7D7CB0F78D23EA0F8E84DE6B9B6A
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  resources/app/node_modules/conf/node_modules/ajv/dist/runtime/equal.js
- Size 286B
- SHA256 c94467da09ee94e5d194483a7ab821b9bb3bf1c04397270f2ab53dea9de59274
- MD5 1caafdf136cb338c5c20791236317451
- SHA1 21975edc011a77c966ad63cceb0ee6995ffe043d
- SHA512 bf1c77e90609f3943a1bb761d726f0854aff27996f031ca14c6ce8869f7d07528e0d5ccacaf3f820dc5cbfa613202c525e294f0ee46c7f4c289d54b7add9f692
- TLSH
  T15FD02B467EF49AF81E605BF2265BA3D371A3843FA018385897D729E501F0C95D255A28
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  resources/app/node_modules/conf/node_modules/ajv/dist/runtime/parseJson.js
- Size 5KB
- SHA256 e830250f5f467a7f4a4108c0712be730ec484e9716d42bec8c928fd8572e6eef
- MD5 964dcfbb803fb2f5026b4e71f1272792
- SHA1 4be42bf5caebfbd47eef45ee34b21fde90aedf28
- SHA512 0bb9e287a5e07c3a86511f9d489af863a08c599e9d3a6fc09e551d549d451b4eb6112464e9dbaf88319521fa91d3b454db44db46975f1d2cb662214f57eabb70
- SSDEEP 96:KEmK7wH3cbdt0ddBfCWX2uiDCYMiAH5nPuiTe6vVnPs8kWud3iMXjetijznvaHt5:KMwHMbEdd5CC2uiDCji2PuiTPxPs8Kd2
- TLSH
  T186B145586CE70410157FB3F92B5FA000783644239318C97DBB5C62A8BF829259BE7FA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  resources/app/node_modules/conf/node_modules/ajv/dist/runtime/quote.js
- Size 943B
- SHA256 1061132b1475fce15821d2b41c74b9ac710f278a33f5dae3385458715cc962b2
- MD5 a1b245c4b29ed44555fe5d9d258fc2e0
- SHA1 37535921ad41a25c3010e6eaad3372407d63712b
- SHA512 d5a6dbcd34886d2f80f1b79ad92a0aaac415e18a5c638496ff63fe91eee6ef7e791e6792b2ffa32d5113211d9033d4e85992f98d465a828be53ac775ff7b5c02
- TLSH
  T121112F0FF8F29C132357D09A0D539510377BA793D880E8B03BED019A2F1806E5220BA2
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  resources/app/node_modules/conf/node_modules/ajv/dist/runtime/re2.js
- Size 213B
- SHA256 e1a6849652ae9a099c36c9aee9d2efc7412c8f83c4b285142413af99a7238361
- MD5 860b7444aebdeb1fa98db3e43fa8b2ac
- SHA1 dcfba0899106f3f9e2ffa7be12ed88e55bca60c2
- SHA512 b1a6048d1dfa6548d1700c0b024e1fc116c5ddf165ced72b17fb80569aae9f2615df0d4a53810ef5e9e4f35b68e3e67458ee2067e8fd1280cae7be0e7566615d
- TLSH
  T18CD023167DF4C5F00FF404D56557D0C15091C879F0123451FBD80FBD011044DDB64751
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  resources/app/node_modules/conf/node_modules/ajv/dist/runtime/timestamp.js
- Size 1KB
- SHA256 05cd4fc283b82af25a2a71ee5e587640c1d42945c74cea790627135fff338bef
- MD5 f1e1d4524fd591258c0b6ec862463197
- SHA1 95070b23d3f5c3520eab7ed6ca14cc96175b0ddf
- SHA512 6e1fa537a60cfddf02ed7d73e24f1ac2e766c23f304089f485d11bfb6eff4bca60be1a461691567e48a2bee88c3af25ee40c3eafc09eedfe6e17b60a0e64c277
- TLSH
  T11F3110A820BB2124D75A85E4038FA8193C67A91F3488D88AFB6D43D01F9949CD331D9E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  resources/app/node_modules/conf/node_modules/ajv/dist/runtime/ucs2length.js
- Size 808B
- SHA256 1df012dd3d23fced07255a7204798004509687cb1f431ae0ab976db436bbd890
- MD5 83fbbbab9bc485a2aac3c26c286bb56b
- SHA1 bd1a1e4a67400e79e9874488b5c77224571f488c
- SHA512 1b436faea5d8394eb0cfe403bf0b2a046d3a83459a46bbbcd639a5a2bedd5b22ad56df64b5fac6b5198ca3cbcf4ca884eb2dec3658df380e228a684a5fc27ae5
- TLSH
  T10F01D0597FF20AC0056429925A1B9050EEF1012B214DF8C8BF0C22C06F40D3CD7D8F96
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  resources/app/node_modules/conf/node_modules/ajv/dist/runtime/uri.js
- Size 216B
- SHA256 356f3e37d4f9b38128f4ce0a0417828609b48908c70d175500324fa9bf927444
- MD5 565fa667b3d3b9ca86353462d3b5763f
- SHA1 c1308885c28f49ef876c0ef684a07c82c0a31b75
- SHA512 7a105c4dae8338cc3ae9be7c98b69eb9cdf693e89f52f5a66e36bcfac04715a9e32fcd9028700e04be49ebb44e88b81bddf27a000eff96ed91b35e8b18284d83
- TLSH
  T1E1D02355BDF4C5F047B018D56637A0C21191C87570273461A7C44EB5055545CD534750
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  resources/app/node_modules/conf/node_modules/ajv/dist/runtime/validation_error.js
- Size 337B
- SHA256 11bf5b4affc8114e5e7cdf65b93006c2d997ab60ada1152c22e136f9b828b815
- MD5 56df0be434c2322bb2c70c0719b3f33f
- SHA1 8dd21321afa7c94a4ffe02d976b52e09c25c1f30
- SHA512 3ce8d9d7f9ea2b8f2c19faa3e0d40bb87a7efe9cbde88e46a1ed96bb1ea1fe666adfc411c0b2233c5c0f8e4dcccd2d2e5addca76d3ecec1e5fe03bf9ef3398a6
- TLSH
  T153E0268A6EB684E7CD2300DB0A46C0C2A1F07057D12A9424779D02F00F40FA4CE81E21
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  resources/app/node_modules/conf/node_modules/ajv/dist/standalone/index.js
- Size 4KB
- SHA256 361d58a7523548bb1b9c782135fae27e76d93c8feaba8c4d613331dbcd3b888f
- MD5 020a8fd9f56ba2032ab9c07c9f5e51cb
- SHA1 bde09f8d079955c4e66404c504cf13781ebc1ebb
- SHA512 c4af28b275a4357c429b09adf0f116dea53b17238b3c5b8198df4dd0f7ee8dc43ccb54552c9509a116452db9ace8450f39604ff092e494497743ddf212583e17
- SSDEEP 96:KxMvn6jTHGIZJiqZAaKw5HJzTnqMnu6MA00mmy0TvxJGvKHQH45YFqApJBzRVKhz:K8n6j7GsiqZAaKw5HJ3nqM7MA0hmy0WQ
- TLSH
  T15B9121CAAEFB64541F1610F84B4BC02162DDA0237458C454BFFC47511FD0A3C9ABAA9E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  resources/app/node_modules/conf/node_modules/ajv/dist/standalone/instance.js
- Size 1015B
- SHA256 4e14aa01e0cb8288fbb75deeb2e738950b0560bd02e1ad8974f391af4c9fc6f3
- MD5 ec49c0a1df116800e8ff22801063dbe1
- SHA1 70e8dc8a48e97efeb15afe257d96e33fd12e8f50
- SHA512 e23c5ecf8885bb9372da282d73456cd17eb5505c55c863c829b14f3d05d83315f89b1f0f6fc51d03fdfb26bee2df68b2513a09eae40c212708e8f8e9dcab8bfa
- TLSH
  T1D8115BC47BFBB4A06A5260D41E076042B09AE6676C2D98BCFE8C47905F8005485E06F4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Renames multiple (351) files with added filename extension

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32