b9a8ae1e6d2c875e21c77f3b9255ca0b3b0b3e0addbb2c3c865e5b95eb734d22

Sharing

Copy URL Twitter E-mail

General

Target
win-driver-xd7d.zip
Size 29.3MB
Sample260623-wysmesfs3j
SHA256 b9a8ae1e6d2c875e21c77f3b9255ca0b3b0b3e0addbb2c3c865e5b95eb734d22
MD5 e6a36a633662da5fcb4978a5828f2ad2
SHA1 efeb38028a699793c5dc37177c315c61461ee56b
SHA512 b40b284155c2175cf69dddf67250827c8ed7628b9d2350eb314d39871d9d1d65965cd8d591cb7972ab3dbaacfdc22369c5e293f2245c94dd8022aaebd12a0e98
SSDEEP 786432:tjFztWSCaOZjtwCjzBeeBZOs020dkFQplbU3cKoXTPHI5hfbGc43j:tjFzwaOZjtwmVDZOs026I0tOToDPW1bs
TLSH
T14167334CD9BF5A9BA251742BC1DB2F13D39A262C105FCC3AFBCA51EB03159D608B625C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  DLLs/_asyncio.pyd
- Size 59KB
- SHA256 cf0edfd508d11bffb63d1b104b6099e0f14ea0fada762f88364e7163f2185f06
- MD5 6c2a86342ade2fac9454b83a49d17694
- SHA1 52946875ad946e4a170072f38e28e10f6037fab9
- SHA512 48d8eb8d20d041df37c4a6f243056607754046ed5f497260751270b42e9eea6f22fb1fb62d015e841d0263534f50bf6c812a6ade0e8bb0a0f79226bc64d05c75
- SSDEEP 768:NCEGDxmtgpeS5l4O7YZUWqJ5ZHWRgE9IaZIAYnc7DG4ythE:N1GDxUg7YTLRgEeaZIAYnctys
- TLSH
  T125536C86E29041A1E967A078D8B34F46E771F5401B00439FA26CD29E3FB335247FEB66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  DLLs/_bz2.pyd
- Size 78KB
- SHA256 4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8
- MD5 b45e82a398713163216984f2feba88f6
- SHA1 eaaf4b91db6f67d7c57c2711f4e968ce0fe5d839
- SHA512 b9c4f22dc4b52815c407ab94d18a7f2e1e4f2250aecdb2e75119150e69b006ed69f3000622ec63eabcf0886b7f56ffdb154e0bf57d8f7f45c3b1dd5c18b84ec8
- SSDEEP 1536:owz7h8B7BjhJCZePYgIjFNf8AnZydTBIAMVyyw:owz18BrJCJgIHEAodTBIAMVy
- TLSH
  T12B738D52B36459F6F06BA27955704347E771BD0D0390C3BFB698426B2F13B916C7832A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  DLLs/_ctypes.pyd
- Size 117KB
- SHA256 35cdd122679041ebef264de5626b7805f3f66c8ae6cc451b8bc520be647fa007
- MD5 79f339753dc8954b8eb45fe70910937e
- SHA1 3ad1bf9872dc779f32795988eb85c81fe47b3dd4
- SHA512 21e567e813180ed0480c4b21be3e2e67974d8d787e663275be054cee0a3f5161fc39034704dbd25f1412feb021d6a21b300a32d1747dee072820be81b9d9b753
- SSDEEP 3072:SHcKPoHQUCFN1KQDCVPJGltBfrShpl7PFIABPI:ShP0ChjCxJGl3frSVzo
- TLSH
  T1A8C34A1B635400EAEA63407CC5B35E87DB71B859172183DF02A4C69E2F637E26E7E712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  DLLs/_ctypes_test.pyd
- Size 30KB
- SHA256 f87b7c3eb696cbe51eca64c665c0526ad479d1d867b7166cd34ad783cd97b77d
- MD5 f8392d68b9af20530b040f43d92c8018
- SHA1 86822a5a9b9a7796121d0fc6a61adc74954c9529
- SHA512 f8997e901fafe5b709ef96e1af8fa1c5dfb3c8dcd840c9dfe7a2c36f1a0cb28f97577c884b9fc94554e64c4a5b9851c2abee35c99fde9e258e9ef001b6545a2a
- SSDEEP 768:Gs97/3EfVFWXdIDis7WPhbkxIAkkrDG4ySh:T7/SVFWNIGs7WPhYxIAkkdy
- TLSH
  T181D27D46FA681C94F9B3453CA0E5CA0EE531B3136762C6EF536582981F13BC633B725A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  DLLs/_decimal.pyd
- Size 241KB
- SHA256 384993b2b8cfcbf155e63f0ee2383a9f9483de92ab73736ff84590a0c4ca2690
- MD5 1cdd7239fc63b7c8a2e2bc0a08d9ea76
- SHA1 85ef6f43ba1343b30a223c48442a8b4f5254d5b0
- SHA512 ba4e19e122f83d477cc4be5e0dea184dafba2f438a587dd4f0ef038abd40cb9cdc1986ee69c34bac3af9cf2347bea137feea3b82e02cca1a7720d735cea7acda
- SSDEEP 6144:xJADMQRl2npdNqRb8o+wmxYk29qWMa3pLW1ALH+4t4g3:IDMQ2Nqi02/U/+g3
- TLSH
  T134346C56A2490DA4DE73807899974B57F7B278940360D2CF43A4CAA73F537A323BE748
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  DLLs/_elementtree.pyd
- Size 119KB
- SHA256 16480ede0430be5249481a9bfb843eb0ef98f93b467a5428352fc23cc8c9051d
- MD5 1fecac327fc93fc161833ad709336bbb
- SHA1 c755ed4ff97eb2f1c73659322430c60de253b732
- SHA512 003d9ccdcb68f5876aad4cb39fecfefd043e70d1fd6ccfd4d672924ae96d69eb4f32dfcd1a643b3a60f0a60c051714c64436e0f6d09a784dd2f92b0800bca067
- SSDEEP 3072:Mx2ad4Xjfa7B5RQo/jmISgUjeuvZpmn9iPfxrrNobnxIAkf+:pm7B5RNiISgShKQxtobnz
- TLSH
  T134C33B5B7165C0AFE462003CA2668F5AD7B2FC900E4183CF6254F5AD9F737923EA9315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  DLLs/_hashlib.pyd
- Size 57KB
- SHA256 50daeb3985302a8d85ce8167b0bf08b9da43e7d51ceae50e8e1cdfb0edf218c6
- MD5 cfb9e0a73a6c9d6d35c2594e52e15234
- SHA1 b86042c96f2ce6d8a239b7d426f298a23df8b3b9
- SHA512 22a5fd139d88c0eee7241c5597d8dbbf2b78841565d0ed0df62383ab50fde04b13a203bddef03530f8609f5117869ed06894a572f7655224285823385d7492d2
- SSDEEP 768:13RNYlTw3glkXa/bNnVXP5ZV17reFyPXS9aEyp6fZIAYIPVDG4ywh2:2TRiXa/bNFLVFPXS93fZIAYI3yz
- TLSH
  T1BC434B0A964000A1D97781BCD9A39F57FAB1F290631197EF9368C1CE2F537C316BAB45
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  DLLs/_lzma.pyd
- Size 149KB
- SHA256 f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e
- MD5 5a77a1e70e054431236adb9e46f40582
- SHA1 be4a8d1618d3ad11cfdb6a366625b37c27f4611a
- SHA512 3c14297a1400a93d1a01c7f8b4463bfd6be062ec08daaf5eb7fcbcde7f4fa40ae06e016ff0de16cb03b987c263876f2f437705adc66244d3ee58f23d6bf7f635
- SSDEEP 3072:3o6xxrSqs+vs0H0q8bnpbVDbX5AyYCznfo9mNomenNjc3KBIAD15:3o6DrScRLCV3twYOmUQKt
- TLSH
  T1ECE33A86A394F4E6F3228C78D6624F57D7F578190310929A02CC876D2B1FB75992F327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  DLLs/_msi.pyd
- Size 39KB
- SHA256 32c09c38867d9fe04cc2ca64c8653556ed8a28a3da113fd61da3ed2b56bb87ba
- MD5 2953c2d8e583fb73a50d782490947b80
- SHA1 899b2df166169e4d1bfe7ed9771cb00eae2a9d6f
- SHA512 d84d075ec8c17ac52749f62c3535c97645a663cdc73d7236751fa7ba1be9a0ecf5d83c9b839d6d96cb98a403cf55e6970fd9d97e3568fb6a305b4e1e248432ca
- SSDEEP 768:t/tZrHlbhqer+UfPxoUAIZdeoLuM3uJYVcClO/wjBIAMG57DG4y+kah:5Pbt1r+UfpuiV3O/wjBIAMG5ty+k
- TLSH
  T1EF037C45A7480892EB738278D1A38F26E624F591976042EF43B1C29E1F53BC3717EB99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  DLLs/_multiprocessing.pyd
- Size 29KB
- SHA256 000486aaac9dd21e88b3dc65fd854dd83519b1fbcc224a70530bc3ec8cbd1a5d
- MD5 fce357f864a558c03ed17755f87d0e30
- SHA1 b74ecb2bee03a8ff209f52f652c011f28d5ae4d0
- SHA512 564dea2bf3410011a76ca5ea376dba3ec9b2d03fd25248824f6c956fa5ea061c1a9ee6f6b65b021ea5bf9cc5e3ab9c6fcf4779446b920891a2c0979bbc57d58b
- SSDEEP 768:PSZtryImJxGC+sPDnrJIAAtDfDG4yKYh/:qLrUJsC+sPDnrJIAAtD5yKy
- TLSH
  T171D26E42EB5818E6E833C53694E39F05EA31F7471714C6DF2258C28D5F7238225FAB5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  DLLs/_overlapped.pyd
- Size 44KB
- SHA256 fe5666c1c8215cd2773744c815fb4a3b2f52f64cf0dde25d458441da22bf5568
- MD5 5bfe7d9e1877fdde718bb84b67d8be68
- SHA1 ebc7389ccca80d92d7b891815843e4c7d066cd51
- SHA512 9fbf4c77784677957b8ade962cc0730ef6cfa865c14c712fd2a978903596a92e359a5234095b2a23d9e4daf7abb4029cd855b91cba696fde448668ccf4a1efea
- SSDEEP 768:hAM30iLUtNX0V896J0yTElpXISZKOPDTb4kydIAttfDG4yZhcKh:hAM3hczNTb4zdIAtt5yZq
- TLSH
  T1B6136B41674404DAEA6B823DA4735F13FAB179A00311D3AF916CC64E1F723E17ABE399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  DLLs/_queue.pyd
- Size 26KB
- SHA256 9ecec72c5fe3c83c122043cad8ceb80d239d99d03b8ea665490bbced183ce42a
- MD5 c9ee37e9f3bffd296ade10a27c7e5b50
- SHA1 b7eee121b2918b6c0997d4889cff13025af4f676
- SHA512 c63bb1b5d84d027439af29c4827fa801df3a2f3d5854c7c79789cad3f5f7561eb2a7406c6f599d2ac553bc31969dc3fa9eef8648bed7282fbc5dc3fb3ba4307f
- SSDEEP 384:ztfqkQfrUC+qFYS9F6N76r1PSMYpKnHgEFIAmUJDG4y8YSNhJl:zOrUC+Us6r1PSMjFFIAmUJDG4y4hP
- TLSH
  T1E6C27D86EA581CE2D433C135A0E25E25F971FB129715C2FF221DC16D2F23782257EB6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  DLLs/_sqlite3.pyd
- Size 91KB
- SHA256 728d21be4d47dd664caf9fa60c1369fe059bc0498edd383b27491d0dee23e439
- MD5 6486e5c8512bddc5f5606d11fe8f21e0
- SHA1 650861b2c4a1d6689ff0a49bb916f8ff278bb387
- SHA512 f2c9267a3cab31190079037e3cc5614f19c1235852454708c4978008ea9da345892191750980aebc809cc83dd1f5788b60f8cf39a6a41623210c96af916d1821
- SSDEEP 1536:6WRj/57JzRFSbiSBYNdS4JkFTH57GlrpD5T82SXEv/cttngyB+HmTq0eZIAYQikX:bRj51g7YNwIkpHsfD5Q2SXttgyB4zZII
- TLSH
  T117935B5AA25000B8E9B781B9C5730B12EB32F8515B2193CF4664C28E2F637D36F7EB55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  DLLs/_ssl.pyd
- Size 152KB
- SHA256 bf63f44951f14c9d0c890415d013276498d6d59e53811bbe2fa16825710bea14
- MD5 11c5008e0ba2caa8adf7452f0aaafd1e
- SHA1 764b33b749e3da9e716b8a853b63b2f7711fcc7c
- SHA512 fceb022d8694bce6504d6b64de4596e2b8252fc2427ee66300e37bcff297579cc7d32a8cb8f847408eaa716cb053e20d53e93fbd945e3f60d58214e6a969c9dd
- SSDEEP 3072:wYb/EGIexVYBgWHaCJaLuJ3TE8sOGH70NmHh4kwooSLteSdo9QBIAM73:wY7jIexVYKUazuJMOADtho9QO
- TLSH
  T1D0E37C47F24429B7E827E4BDC2634902EBB5F045231187DE49D5C68A0F13B46AE7AF63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  DLLs/_testbuffer.pyd
- Size 48KB
- SHA256 89aea6308d484778e9f548513afa16c5cd2078adf476b801f4cabec22fbc6a1e
- MD5 3685baef533639357c971abf7cd4388d
- SHA1 469f1f09c726fe0469d60bf45ce5c70af555f093
- SHA512 6d3e7bfe1c4851bc9f1c44ba2abc7f6055025b96728caf18728abe5bf0b481a2485f7a3752eed48f502ded90e20b0697ed8fdc8035b77dc5949ad1fe51508640
- SSDEEP 1536:6g2PF01DdmRkN9YevOAWch+5Jf0xKdIAt5bySb:92PF0tsqw1chWJ8xKdIAt5d
- TLSH
  T19A239E9AE76800E6E927C176D5725F0BDB70B1425B00C3CF1068C1A96FA3BE351BE726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  DLLs/_testcapi.pyd
- Size 123KB
- SHA256 5839fde33b3320fa6ce6f126f2838194338d3ab483f18b98cba89590514c11a6
- MD5 6d545c221207c9f220d6c81c9e686de1
- SHA1 1d9108ed6ee1af71ba243d758eb603bc37b84678
- SHA512 7227af950fd6efa043baae4554596fdd1796c3d16341a411b899757f9fe842c7b15119bd15924d5f24b8e12fc79e4f1f83cf359503b0a1611783e017b09edfdf
- SSDEEP 3072:eQatMagT8FjOYqc8qZhPdfW/NPfTsvffepwFwp0w5Jgw9w/hem81wffh+aM/5iV1:eQatTgYwqZZGnZ2Mi1/cg
- TLSH
  T1D6C30657A39520C6E9A695BCC8339F13AB21F160531053CF44A0C64D4F27BEA6FBEB91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32