aebdf335913eae4270b585339727b44593a98d17d73a3aae80e4d46d27c01310

Sharing

Copy URL Twitter E-mail

General

Target
PuloversMacroCreator-Portable.zip
Size 10.5MB
Sample260623-rjbcdadv3j
SHA256 aebdf335913eae4270b585339727b44593a98d17d73a3aae80e4d46d27c01310
MD5 302961d4f47822a55127b69e5e43c6f3
SHA1 36fcd76ff209050155308355e4881f8cec18079d
SHA512 8737b21ec71af8130456823df7962d3e55f4edc7513c30e2aed32a04af81a912d7bca24840b70933c8c64d4f7ed459c1c4225c1ae78fd10ae2ca5990916a6189
SSDEEP 196608:uj30lgIF+8k/oSpfKKcsIV3NJOrL10QUfW4tHRc2Oj30lgIZ+8k/oSpfKKckkdrF:u4lgp83SZnFy0rL/CZRxO4lgB83SZnJc
TLSH
T12EB633FB84297995E7C7B327FC2D0050A66204E6FD046ABEDFB695C30DF40E1A395A84
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  MacroCreatorPortable/x64/MacroCreator/Bin/leptonica_util/leptonica_util.exe
- Size 8KB
- SHA256 27ba16897876f738013d1eb05c05d15832c571eebb80ca24be7c474a32cb7f40
- MD5 333f5aa70f79af2b88b03ee3ea4e81cc
- SHA1 24be5c21be57d489beefb6b03ffbd9603baf7fa5
- SHA512 440ca02d87ab71d1a314abf60304e3e835ab10b3fffb066537bd351c84d26994f934c24311f0c5cad7a5d60ef931c3fe09d622e7e697576797639251d2584188
- SSDEEP 96:/Wj76UzJYog/EpCqgd/DDSZXqk+U9vr9ns1dJJGI+RqMyC7tCE:ej71rBpRZXqk+UHs1dJJ9EqMP
- TLSH
  T180022A075C578072E39C0CF027B256DA8F3D452337D5917BBF6309A88FE066164966AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1
- Target
  MacroCreatorPortable/x64/MacroCreator/Bin/leptonica_util/liblept168.dll
- Size 1.6MB
- SHA256 6583ac30c54a694e484ddca82c4837677fba9f0e490d389e17904ce4f6840dc4
- MD5 259f27067a4c16cd44666fac1f8dd692
- SHA1 e28d2eb9abb9b82f5f9930c59ce27d6bff74dc84
- SHA512 cb8eaa8178a913f7640e4f2e5b8b53a02e28234a22cef47a0abecb9ebbbe34fd747c0573dcd47a4db868087a7ef36070a138d6369d52b0a1dea74f602d55e878
- SSDEEP 24576:MICtwM40Fr8WsA/4cKkqzPP/IFU3w+7peD//hpGfN6stGtK0HsaWIJYQfIbDokjz:Mx9rF2cKvPoFAmhperGtRbCokZT5
- TLSH
  T175758D42C7C680F2EDB6247842B3963A693157055316C7E3E3943E72FB117D2A97A2CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  MacroCreatorPortable/x64/MacroCreator/Bin/tesseract/tesseract.exe
- Size 3.7MB
- SHA256 c0928eb1f453a4df23432227f87bf7fe8530534eadababca471a31ff58ceca63
- MD5 6bb24e206c626bc2a74d35cc8a829279
- SHA1 e45027dec7e8f4bf9dfc964ec6d119dd61e40c70
- SHA512 26ed1c383bf5c3e387f17b2137dcedb357b7e5282f87458031ef3dfbfe222db8254393a759d9f3f8db19f91370d11c5065757a90f75036d074c76be198c786cd
- SSDEEP 98304:tDOaH1kBT4yTKJvrpgO2SrC05vnon/RQ24x:tDaBMvrGvSrC7mh
- TLSH
  T1B106AF11AD81C136F4E100B1D66D6BAF267C8664172988D7C3D828B83F647D3A773B9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  MacroCreatorPortable/x64/MacroCreator/Lang/lv.lang
- Size 70KB
- SHA256 d794a08e81ca2b7c130f9c78cdf52920684382832f79cfc669c58f4dcef18420
- MD5 311c09aaadf5b725057b4576a7ddcbca
- SHA1 f07c6ce621323972a87d06ebb2c01b7ac9282f75
- SHA512 a63ea7cc9b8bafd7d4915d236a7d4c2de8071c00754aaa2647dd323ab59a565aab080bb355b395e7c8f41b997dfabcde0e91cd15142db620dff34c5ac4fa154b
- SSDEEP 1536:qMXgITGVR2dm62M6sXHyDE6mzPv0lCRpM+E4O6W0e8bU5H68NPMuP3TJAsgXAiOT:qMXgITGVR2dm62M6sXH36qv0lCRpM+Ej
- TLSH
  T131630808BBCD5A689C52E3A8B23552E3DC98D98327079B057347E6356EEE464333E5F0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral4
- Target
  MacroCreatorPortable/x64/MacroCreator/MacroCreator.exe
- Size 2.0MB
- SHA256 711a8ceea0ae52371394b35a00d0b57893e4abcaa29ecd9e34ba86fae93c9277
- MD5 ee8ca3d88b0d80ad5e0bc270bfbdf507
- SHA1 ea91d3c7f056e92c1cc45d021c14bca3b7a43673
- SHA512 119a3bbc64eb137e31d004cbb6aab25776cd1843acf5504406b5851f4844ce6b574ab1145981a84d9b912c6331ef04429a87668ca3850a364d6141252dc244e8
- SSDEEP 49152:6D7Xroy0DPP23Iy5YAmw6B8If0F3IwowbGX17JxBYBGJI6GxBl:6Dnoy0lyag6B8If0FZowSla/t
- TLSH
  T1CFA59E463BA369E4DF83C0B8A3241C12EB757C150B0C05F775A969ADAEEF87142B7712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  MacroCreatorPortable/x64/MacroCreator/MacroCreator_Help.chm
- Size 109KB
- SHA256 3d452ec7d5a78859e84f82fe471b1d8dba8ea8ef196763b20877ee3e38f3991d
- MD5 0e7c86d54b369e372d575369d6d32634
- SHA1 b6ef81e9560b1733852c29aed831f9d67c299334
- SHA512 c95ff6cef06831f5b1dd852a4be722694e925cba1730dc31a5adc474d7c62720a37137ca81ab11c1335dcda3ae333cd7a345ef67c9e614ec11a50f8130491def
- SSDEEP 3072:yy8vwxSlWjcrcIPHekrNO7a7soMRT/PtOr8NBpJh4:yx704rr+krNBAXbPtOrSfQ
- TLSH
  T14FB302230BB90572D5069E7F9DC4348DB6C4CBF434899AE6D43938AA5DB3B0690D2FD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  MacroCreatorPortable/x64/MacroCreator/Resources.dll
- Size 458KB
- SHA256 e84149ca05c423d2024cb118d31afe8ae79356511bb78fcb5e676fd16822edbe
- MD5 e8ca33f9f239f333244bb7272e9fe513
- SHA1 eb23736ed4b29613c1ab83d554812b9551ef4e8b
- SHA512 5fdd7bb8d7df22f51d913c601481c50234ef85f7f8c41fc043f869f8d39b1ea9f938a30c285f3440d8cb6ad4b04111287ce0d835fecb5018a431b5abdca1ee61
- SSDEEP 1536:oCxpwL0BrEboKTk4/nlTuQtozYu7fIjpQi3yKuXQFoqT0b0cbafrKjHZ1YFR3335:XwcEEKAS9uUkfIjp9sNIOx/xxpXer
- TLSH
  T191A43F45D4528C2BD436A6B0C446D1A738D8BD07B794F70BA1C5BE1AB47D02DAEB3327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  MacroCreatorPortable/x64/MacroCreator/SciLexer.dll
- Size 1.2MB
- SHA256 8d92f6c5f9f2643a8b323cd2ca50687bdc76103cfae9387335d36a7d73100c94
- MD5 391eb70f24f8276c1e857063e87c4495
- SHA1 6e3fa164cc03bcebb95e5752764e3660dc85220a
- SHA512 eccf636e58693605f83a7cb3bc97047dc62159d35736b976dc238615c34827b37b737a1d6039dd23a619fa274007600e1ae2c5da794218038905170a64cd9c9c
- SSDEEP 24576:heZPeJPSJNRJhW22wdjF7LWnha+dkubXMbQRGmzPwE0D409krFD:qWl8JhWzwdjZOHdkubXMbOGmzYE0R9E
- TLSH
  T1B5458F8472EA41FAD466803CCA6A9217D7F238411368DFEF16E047A57F23BE51A7B311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  MacroCreatorPortable/x86/MacroCreator/Bin/leptonica_util/leptonica_util.exe
- Size 8KB
- SHA256 27ba16897876f738013d1eb05c05d15832c571eebb80ca24be7c474a32cb7f40
- MD5 333f5aa70f79af2b88b03ee3ea4e81cc
- SHA1 24be5c21be57d489beefb6b03ffbd9603baf7fa5
- SHA512 440ca02d87ab71d1a314abf60304e3e835ab10b3fffb066537bd351c84d26994f934c24311f0c5cad7a5d60ef931c3fe09d622e7e697576797639251d2584188
- SSDEEP 96:/Wj76UzJYog/EpCqgd/DDSZXqk+U9vr9ns1dJJGI+RqMyC7tCE:ej71rBpRZXqk+UHs1dJJ9EqMP
- TLSH
  T180022A075C578072E39C0CF027B256DA8F3D452337D5917BBF6309A88FE066164966AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral9
- Target
  MacroCreatorPortable/x86/MacroCreator/Bin/leptonica_util/liblept168.dll
- Size 1.6MB
- SHA256 6583ac30c54a694e484ddca82c4837677fba9f0e490d389e17904ce4f6840dc4
- MD5 259f27067a4c16cd44666fac1f8dd692
- SHA1 e28d2eb9abb9b82f5f9930c59ce27d6bff74dc84
- SHA512 cb8eaa8178a913f7640e4f2e5b8b53a02e28234a22cef47a0abecb9ebbbe34fd747c0573dcd47a4db868087a7ef36070a138d6369d52b0a1dea74f602d55e878
- SSDEEP 24576:MICtwM40Fr8WsA/4cKkqzPP/IFU3w+7peD//hpGfN6stGtK0HsaWIJYQfIbDokjz:Mx9rF2cKvPoFAmhperGtRbCokZT5
- TLSH
  T175758D42C7C680F2EDB6247842B3963A693157055316C7E3E3943E72FB117D2A97A2CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10
- Target
  MacroCreatorPortable/x86/MacroCreator/Bin/tesseract/tesseract.exe
- Size 3.7MB
- SHA256 c0928eb1f453a4df23432227f87bf7fe8530534eadababca471a31ff58ceca63
- MD5 6bb24e206c626bc2a74d35cc8a829279
- SHA1 e45027dec7e8f4bf9dfc964ec6d119dd61e40c70
- SHA512 26ed1c383bf5c3e387f17b2137dcedb357b7e5282f87458031ef3dfbfe222db8254393a759d9f3f8db19f91370d11c5065757a90f75036d074c76be198c786cd
- SSDEEP 98304:tDOaH1kBT4yTKJvrpgO2SrC05vnon/RQ24x:tDaBMvrGvSrC7mh
- TLSH
  T1B106AF11AD81C136F4E100B1D66D6BAF267C8664172988D7C3D828B83F647D3A773B9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  MacroCreatorPortable/x86/MacroCreator/Lang/lv.lang
- Size 70KB
- SHA256 d794a08e81ca2b7c130f9c78cdf52920684382832f79cfc669c58f4dcef18420
- MD5 311c09aaadf5b725057b4576a7ddcbca
- SHA1 f07c6ce621323972a87d06ebb2c01b7ac9282f75
- SHA512 a63ea7cc9b8bafd7d4915d236a7d4c2de8071c00754aaa2647dd323ab59a565aab080bb355b395e7c8f41b997dfabcde0e91cd15142db620dff34c5ac4fa154b
- SSDEEP 1536:qMXgITGVR2dm62M6sXHyDE6mzPv0lCRpM+E4O6W0e8bU5H68NPMuP3TJAsgXAiOT:qMXgITGVR2dm62M6sXH36qv0lCRpM+Ej
- TLSH
  T131630808BBCD5A689C52E3A8B23552E3DC98D98327079B057347E6356EEE464333E5F0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  MacroCreatorPortable/x86/MacroCreator/MacroCreator.exe
- Size 1.6MB
- SHA256 7ac6e29b98cfff645a491f7c1dd93fd7f6e1a40ff925d656a15a8869eb17614e
- MD5 6b9361c14415d4ad625b6082784da5c5
- SHA1 7b535655cc12a2f079bed77ebf4556580ac0c237
- SHA512 074ea9dd90b93a238e41dfd554b3b564f0524f4f50df754662ae62d51f318f4d5c3362dc45de5a6b4ac0c811cb806fee6fcecd38e4c1f19379e6d4545ba4c91b
- SSDEEP 24576:QcgANiXhDSAazebRRkuJjoeVwGpYBpuuQTJcIi0ZrputwGx//zzjIY:2JsC9ye2GpYBGJI6GxvL
- TLSH
  T11A858D567BA3A9A1DF8250F873641C619F38BC29471C04E773AA39FCA8FD4B151B6702
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  MacroCreatorPortable/x86/MacroCreator/MacroCreator_Help.chm
- Size 109KB
- SHA256 3d452ec7d5a78859e84f82fe471b1d8dba8ea8ef196763b20877ee3e38f3991d
- MD5 0e7c86d54b369e372d575369d6d32634
- SHA1 b6ef81e9560b1733852c29aed831f9d67c299334
- SHA512 c95ff6cef06831f5b1dd852a4be722694e925cba1730dc31a5adc474d7c62720a37137ca81ab11c1335dcda3ae333cd7a345ef67c9e614ec11a50f8130491def
- SSDEEP 3072:yy8vwxSlWjcrcIPHekrNO7a7soMRT/PtOr8NBpJh4:yx704rr+krNBAXbPtOrSfQ
- TLSH
  T14FB302230BB90572D5069E7F9DC4348DB6C4CBF434899AE6D43938AA5DB3B0690D2FD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  MacroCreatorPortable/x86/MacroCreator/Resources.dll
- Size 458KB
- SHA256 e84149ca05c423d2024cb118d31afe8ae79356511bb78fcb5e676fd16822edbe
- MD5 e8ca33f9f239f333244bb7272e9fe513
- SHA1 eb23736ed4b29613c1ab83d554812b9551ef4e8b
- SHA512 5fdd7bb8d7df22f51d913c601481c50234ef85f7f8c41fc043f869f8d39b1ea9f938a30c285f3440d8cb6ad4b04111287ce0d835fecb5018a431b5abdca1ee61
- SSDEEP 1536:oCxpwL0BrEboKTk4/nlTuQtozYu7fIjpQi3yKuXQFoqT0b0cbafrKjHZ1YFR3335:XwcEEKAS9uUkfIjp9sNIOx/xxpXer
- TLSH
  T191A43F45D4528C2BD436A6B0C446D1A738D8BD07B794F70BA1C5BE1AB47D02DAEB3327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  MacroCreatorPortable/x86/MacroCreator/SciLexer.dll
- Size 901KB
- SHA256 1a3cd26848e5cea2279775895652fda8af8e82d9cb961fa622bb2c8982bcbd9d
- MD5 dec9c975686613643ac473837cf0286e
- SHA1 c52fbaee35430a961873a381598a069d66bee4a5
- SHA512 91afa4350750555ad2086b9482ecfe8e6fd3c9cb46a58525c2d65f3c159280d23d031eb288d9f37853f8826327994fff3a9602e96a12217f13ea6757105c2b54
- SSDEEP 24576:L2E45ThfIPVon8iG9vbpAFTKwoA/dFMcktm+9a:ufx8R2Po6sm+E
- TLSH
  T1C1158C90BA87C0B1DC8F16B1A9BDFF6E426DA50A4738CCD7B6C41C09BA345D22639357
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16