61490daecab1acc925f3f0cdec09a51de9ec8312d2dff9f8da6184a1a2645b5f

Sharing

Copy URL Twitter E-mail

General

Target
BetterTinyTask.zip
Size 84.5MB
Sample260623-fd1vasas9r
SHA256 61490daecab1acc925f3f0cdec09a51de9ec8312d2dff9f8da6184a1a2645b5f
MD5 fb3d9ffc2bf30b30ac0fa6f26c34d95d
SHA1 594162c88c5ccae0adaff2a04bc5cfa9a71d0970
SHA512 8fc6af9442e7e62c29239ee4016d5086acf079556ab98dfd16b0f26e34d97d6ce02f4073a7823cc88326cdaa33b666b2449ba3ccfa9d2db3757ac0356650a4b8
SSDEEP 1572864:oJ7yROLpL1o1Ec92Ziw6DH5EkMLyZMYh7a8qr6Jzrxlpv/RC6U3RYtp8+sTibrAC:yWcLpy1MiwAH5ZL7Rqrozrxfv/Rpk+CE
TLSH
T17718336FD9046072C14F9BBD1984B38BE174B17A33F2564E2A3429C6ACB76C14B26737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  BetterTinyTask/BetterTinyTask/Launcher.vbs
- Size 752B
- SHA256 467651e06ebe0fe3c85971d87a4ef96e39c0c4e07d09c7f15bc82c8de4a6682e
- MD5 efef73332d31b16f16ca5db820517962
- SHA1 027a98da4b22fee149aedba40c9cf68943b0dad5
- SHA512 a04fa9a2c1fbc31e8c460d1c0dfe01973e67baa4be0eb7cd922cdb7ef4268654648cec2a68448a404e69f667f92a89a1266c144b878b0d70f4eb7244e0d5ac37
- TLSH
  T10601D002D7C3DDF208A3C823620F2C8D8A3860252214786D797D54E8173D364475620A
- MD5 SHA1 SHA512 TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  BetterTinyTask/BetterTinyTask/python/DLLs/_asyncio.pyd
- Size 72KB
- SHA256 e79dcc4ee292a9b93143674c3509743ef0496fd32e53c55b93f13cc402f815e5
- MD5 a577ff6de2add83120127061d7c294a8
- SHA1 ad934f30669eb873b1240f730999207ffcd24605
- SHA512 9caeda83dedcfda6f857a684a3587758e92d5bef0238823ef7cfe2a8b267b7f228af0ce1184b56b9eb410424bfd22b9fbf56c2b35a671bd7258768e544162386
- SSDEEP 1536:6Fc5RUrojeb8QNAN4tnkzGdIBOnI7yo47Q9iYfIgHMR:66wrQegQ2N4tnpdIBOnI8YA
- TLSH
  T115739E86A2A4418BDD97F2B4C1636F53FBB0F7421501479F61A4C28E2F6379183FE626
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  BetterTinyTask/BetterTinyTask/python/DLLs/_bz2.pyd
- Size 84KB
- SHA256 0ec5bdf4c688c1d2bda00f61e1f9e1369188c1019173a5412981f6569a997347
- MD5 8bd61ea798d1e3ef58548480ed8ee956
- SHA1 5b8f0d59cf362b7da4a844086dc4187d4b2a4d75
- SHA512 2329ccd91dbdbc65e071130a1fe072608420dca4c4a96ba5fd1d32b0bfd56d6be048b4f99a423774b6d00f1be506fec6103700d3bbf1d14302123c9f71488b8a
- SSDEEP 1536:rmNz7JrA+VLsS7XtGHakUwFHkklB885vBNiR1iFIBCVA7yo47Q9mfIgH6D:iNzdb7XfQVpz/ZBSYFIBCVA/Yy
- TLSH
  T1D6839E86E76962F2F85F81B986D00793E730BA55075083AFF294C2592F03F916E6C35E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  BetterTinyTask/BetterTinyTask/python/DLLs/_ctypes.pyd
- Size 124KB
- SHA256 ed4170b2c2c302639301a01c6aac4c5575e6e4c936edc803d3ba6c34444e35e1
- MD5 fc2da679024ed27f02ecd1b05cf14cda
- SHA1 5b5f4436e0527b2540aaf5407b22e8f410e6afd4
- SHA512 0fc6b5fc862a0c528fe4fb8bed97d2622e0f1ce9fddb1005b138041859cd307119e9a35854aa9af9be6972ce71c4bbf3a587db73c78cba09131ae79b21a06e9d
- SSDEEP 3072:YHcU2CMTT6mCZwIj+3ffEQj6ED434JIBLPnKZ+g:2tTST6mJNffEQuo4gT
- TLSH
  T1C8C36C4B335400A6EBA35178C5B3AF47E7B1B45B171093CF12A4C6992F637A36E2E316
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  BetterTinyTask/BetterTinyTask/python/DLLs/_ctypes_test.pyd
- Size 38KB
- SHA256 17653f7c98ef8d54dd440daa9bcc7541daa8af4668e6da8b1051c860e875d5af
- MD5 69b0b5d5a264518dcf5010d4a56b295e
- SHA1 a70ec8e6fd6f8701bac1b75870b4e0a60b2ecb6f
- SHA512 b50fa0bd5b8e85b7bc0be3af9e6d7cac857dffafd8b03ecbdd11e2abbb44ebe7d193aa989c1b5ef8a60e13be959303fdb602fc8da44ddaa0c168244ba9bf1799
- SSDEEP 768:5SALlp8RoyltIQrTnj1IB6kYQ+Eyobo+Y7N2Ip4WCxf1mlPrM0i:3lKRoKtIQrTnj1IB6kp7yo47Q9zfITM1
- TLSH
  T1D1038DCA697D540AEA73863C80FAEA47F436B3D32761D7CF22E5858809137C5633711A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  BetterTinyTask/BetterTinyTask/python/DLLs/_decimal.pyd
- Size 253KB
- SHA256 b6edd193dc93d61846be47addd36655aaaf6749ea0409564d04bee6f785ffa15
- MD5 5d54c76a09515d513aab1dd43c401418
- SHA1 1885ffb0c3d44fef67957e5849884af8feec600f
- SHA512 6445689a05c6ae0caefeeeecec590934122ba49d124da3e6abfd78e228f959cd666f19b416425caa996fb4d9124ff74602b012292002bc0b148aff92fd8303f7
- SSDEEP 6144:VUL77hlqmBs47lzaajssE79qWM53pLW1Axthh4/:QhcmBllmagsVthc
- TLSH
  T1A2446C17A2490DA4EE7380748897DA47E7B278964320D7CF43B48AA76F577A3237E344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  BetterTinyTask/BetterTinyTask/python/DLLs/_elementtree.pyd
- Size 131KB
- SHA256 9b72b42c3fa741025d760db945d47f948271c884e61e5cbfb94f1c99b0446636
- MD5 31db8f46221e06e997c0fa3ecc07d206
- SHA1 56dfbea5cb093779ebd8c3cdb1c652359a2a49cd
- SHA512 17bb333cd5566d8e8082156c84dcb222b3d0f7391757479dbd3c10d6851e8a768475f096424c5e9afb190f56824ae5f6dc04ea8959a318a9b367128e09169f96
- SSDEEP 3072:Ao/eVopIITRs+sgybcSfy7aTEktSKcTyEXL+HF975xz1IB6fCNLIv/:AoYITRPKbc8yWZwtRqP75xzcEn
- TLSH
  T11AD35A5B7261C0ABE5935039C6678F46D7B2F9A20E0183CF6284F66D9F233923E69315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  BetterTinyTask/BetterTinyTask/python/DLLs/_hashlib.pyd
- Size 65KB
- SHA256 dfacbb48ade3d53780ff1e6875da90930a4a5d593e21984779079bd6f98f3768
- MD5 d0a2127b7aa88b6a47c170c933402438
- SHA1 d053e9bf85c8e1333d93fb392e4b67504c069d9b
- SHA512 ed9a14cb8cad7ef0f47116fab28578b9335210c5fd2c2c3c1fb658991d807c1717d80e69ab2bdeeb5e11a64a317b0265dbb71c790587b35b6dedf97a102e4b34
- SSDEEP 1536:XxO3I17jZRoh31BV3WdIBOI87yo47Q9VfIbN:Z5ZR01BNWdIBOI8ep
- TLSH
  T10D638D09A65540A9DA678174C9B39F97F9F1F2421B10A7EF4264C28D2F237C3E37A316
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  BetterTinyTask/BetterTinyTask/python/DLLs/_lzma.pyd
- Size 156KB
- SHA256 ed997ca4956fe7e27cc702adaa8d31136312361d285b7b845c8829d8c5a89ae8
- MD5 9ec7f84b1976b469c4fa4001d5ff4412
- SHA1 17471c690540fbccd653f31676dce3c829a6b9de
- SHA512 2d52e31a5467d44848d63d7f9ad07575af7c8762eecb7ff078a3d9ef334988d54f5711566eb841a8bf3d17ce1873c2dca02b6f355f41204be5505517c3b3b5bc
- SSDEEP 3072:gA1h7DfXFDu7NjQ69wJGznfV9mNosn+RNd/lHNiFIBZ131Yi:gMDfZOv9YOsMlHNig+i
- TLSH
  T1B2F34B86A394F0E6F7628C78D6624F57E7F5781A0310928E01CC976D2B1FB659E2E313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  BetterTinyTask/BetterTinyTask/python/DLLs/_msi.pyd
- Size 45KB
- SHA256 03e0c6d710e884edbc9279d4a8ea1b76e5972c8bf6c2ff0cefb133a3d5459f5c
- MD5 597fc833d1f702b872a827df240c3cde
- SHA1 feafcf397640469dc4ea8938959711f4a25787a7
- SHA512 dea5f3628c213aad97e2488029b07cfe2b202f2c36ea24e4775f9e68ee3c255648fe9639158b3fa58f056f0e4dc9d3e1d88f49b3746a889a3c0f7696ede4ad82
- SSDEEP 768:ojO12AJvIskT9d2jrfPxoUAIZdeoLuM3mdYVPRnUsTcCuj7FIBCGTRQ+Eyobo+Yh:ojEuT2ffpmGVPRnZTCj7FIBCGTa7yo4h
- TLSH
  T10A235A896B5C0142EB6791B4C697CF56E538B2D2576042DF61F0C28E0F53BD2E33A78A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  BetterTinyTask/BetterTinyTask/python/DLLs/_multiprocessing.pyd
- Size 36KB
- SHA256 4616e0b5d2780f30584d031fbef4dea7a1b364aa3dc7a260c0dc02d19cb7cee3
- MD5 32150bed522e6c151fef8027ad4691e0
- SHA1 33ae66887f7cb9b7d565d90462c94d22430f23dd
- SHA512 064b06ff6f42d0d06eb6c5934b33f308de2a801abe0eda44232f177b5a25f5efac83ad647297c4b0f9f08ee18a98ea46bf60a34c35d40655b88d0a281c1e53d1
- SSDEEP 768:qlpp7OBajKCW2lVA06NuNIBWtAQ+Eyobo+Y7N2Ip4u+Txf1ml/6dHQDZj:WptOBa8YVA06YNIBWtB7yo47Q9NfIgH2
- TLSH
  T134038E8AA6684047E567DA71C5E3EF46F535F7830A21865F61A1C2CE1F73381A36D30E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  BetterTinyTask/BetterTinyTask/python/DLLs/_overlapped.pyd
- Size 56KB
- SHA256 2c0f17ea5ae1a9f8c1c7d4da1c0cd7d077864174b33bb65a479bdf5e76248d3b
- MD5 e9436905d28deaef3b04e1fe2f05d7c3
- SHA1 59aca55c1847208d7adb75bf727d3cec8bb4fc07
- SHA512 b573670085168929c34606836c61e58019e630de7abd5e01d6162f91774ff5d999f5ea0ad69b4e46f30a96dd37cbc2b5442c813fd2723ccaeb07962b9b563813
- SSDEEP 1536:U+rYIgKZPXjCJP+eZqIDrhIBXtz7yo47Q90fIZRF/:IJP+eZqIDrhIBXtzlZj
- TLSH
  T1C3438C49679801DAEE63D279D5A38F07FA7472D35610931FA1B8C68A1F73782B31E384
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  BetterTinyTask/BetterTinyTask/python/DLLs/_queue.pyd
- Size 32KB
- SHA256 eb4070d87384565985a59a7139e0903b120044059cb0934a9a425c360e93a34c
- MD5 2ce0e1816468940a4025efb31cd75150
- SHA1 b71fb6efc1761e3735f5693f68feeaa964acf3af
- SHA512 d778df0747a878ba71ea496d5a67ead26ccc69ab88ecb03a593520968905854c0828259c148c55917c04975e714c5c931b7fce4fd0e9bfb331dde4aa7eb6e6b9
- SSDEEP 768:L1zRmez26rGFQFr4JIBQUygQ+Eyobo+Y7N2Ip4reCxf1mljr8VMA:lRm0DGmFr4JIBQUyh7yo47Q9/fI38VMA
- TLSH
  T179E28ECBBA684047EAA3D970C1B2DE92F535B7D3560187CF2066C28D2F177C2A729319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  BetterTinyTask/BetterTinyTask/python/DLLs/_sqlite3.pyd
- Size 124KB
- SHA256 a75cccd75e15e6d9004cda0ed022e86413e1c3f7f02faea3ac990f2f9adc64a4
- MD5 d8830605d340b89523cfdfa9094ba7d8
- SHA1 adc00bffa05f4329b0d20ade02f8b99687c33987
- SHA512 0d866b02d69fcb509248b4c88a0104f779eec56fd425bec1ad83084316e94685931c69b922def368bdc23dcf6604245e65772d50503580591eee42cc6b0f583d
- SSDEEP 3072:NNLWCaLj9y3Vb3CO4w5yDkUZMfd9dIBOQtwZC:NwMbyC5EMfnE+C
- TLSH
  T166C34B6B635400AAE9F751B8C1734A03EB75B962437093DF41A4C6891F377C2AF3AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  BetterTinyTask/BetterTinyTask/python/DLLs/_ssl.pyd
- Size 174KB
- SHA256 78728b5e06037e3adfe922b59bb1dd19dea391e9ca02e21caab3cdc832111036
- MD5 3eb767de2c65e7f5ece308bfbe4f727c
- SHA1 01a206345ee54a21fb5ffb29bbb45b5b2a8dfa15
- SHA512 1dbbc180da6901a13b70df4e30a5568667ad0cc8963a254a00da0d7dd5dd4ee4805bf1375444100b25e364b2f473778feb16f5221df2734fca421db5323705f4
- SSDEEP 3072:+yLOMXM9cDI0iCTU/fZ6XNs7GV9n2gkKuFBZd4rYcvsswCfyX0No0FIBC7AiuX:+6OMXMWDI0ZgHZ6XNDt2g9w0+3
- TLSH
  T148048C47B5946AB7D813E4F9C2334903EBB0F116331257DE48D5D64A0F03B4AAE6AB63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  BetterTinyTask/BetterTinyTask/python/DLLs/_testbuffer.pyd
- Size 56KB
- SHA256 9c9c3820e861771e18125086096b7d4a1a92272c9e4f721f4e9109e8080bc7bb
- MD5 948e3bdc9f7399f0a2dbcc86f9b647fc
- SHA1 c6d20dd0f215c13dcf6ae1162dd019862cf89bb7
- SHA512 c366b6722cf7c640d6ef97ef8d12e0e493c797db9135d3db91d787e480196e20086104876bedd17d826cbaef9eb4c2ccc0748b37e9154ceb69414dda4cc0e674
- SSDEEP 1536:+D9kk09s6NTOAWch/mvovDxRxybhIBX5nDi7yo47Q9lfIgHr9:+D9kAch/mv+Dx7ybhIBX5nDiOYZ
- TLSH
  T19D439E8AA3644096ED63D1B5C172EE13EA74B293670193CF10A1C65A1F63BD2D33F71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32