ed226b03942b816e44a66c56296a833d18751cdc254855a0422098bcf8fe0c48

Sharing

Copy URL Twitter E-mail

General

Target
Voces artificiales.zip
Size 185.4MB
Sample260624-mc9jdabt61
SHA256 ed226b03942b816e44a66c56296a833d18751cdc254855a0422098bcf8fe0c48
MD5 303354f8a4ca3fe6666341146b7a9d41
SHA1 b85f2e92ff2089dd90884cd6ca1ddff45171c7b3
SHA512 189b3a861616bee87f183910f2e68b9635f755d36abea4a9ed719ff7ace3fd1a133d8dbf7e55b80193908942671c28933beafa64ae44a9260aa74657dbc642ac
SSDEEP 3145728:x50nizC1MBUIVhe00jAESxxAUde4H3Yy5M39Jb9p+u7I8M3tjv8S6pTVAc21Sfbv:xSiu1Y3TUUxCUd/3YE291e7dT8fpv21c
TLSH
T15998331E150D51A13F9EFD54998E1AD4DAA735F1F0B01DAFEAD903CA93AA7803432ED0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  LOQUENDO TTS DIRECTOR/AutoPlay/Docs/Carlos.exe
- Size 41.6MB
- SHA256 cafea3ee2eb63c820715b8ffc1a08ccdca9c9335bb53827a260f36f6f765b008
- MD5 f07d15e48b967aef1066ff1ef555abe0
- SHA1 602fa49358bcbf635823b987f2da5f1d6dc5cc14
- SHA512 d0b1dc4f7e0fce576700423e5468d3e0966bffefbefc0cd1db4dc118f995a820b178eb71f1ff2807ddcf805cfe929bfe0c1b823d4ae8965a99a45f8b6d3f2657
- SSDEEP 786432:vLd7phqrDdUddtKxJwq5Ejht8HF+tUUZ9QvLow9oK3og:TppIrB6dwHshYF+tNH3g
- TLSH
  T1F4A7333F3645C632D24D79725B3F0EBE0AF33D62C8154E9B1629BD962B31A1119B03E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  LOQUENDO TTS DIRECTOR/AutoPlay/Docs/Carmen.exe
- Size 36.0MB
- SHA256 7fa668fc382a83ebd76c2877983e841610248549f7c7f5d168cc4fe436f0f583
- MD5 e283162f6fe6132cbebb6f8faf031969
- SHA1 dd06090ede1d2b9315777d5ecd66333e100f806c
- SHA512 2e8e9ea2e06aae780e5ef95f575bdb1c690a5f7e2710af194b62fbfeaa7a87aada6662605fe7aca1ca71e1c4bb2c3e0e33c5bc2ced8535a025858370768ff2c7
- SSDEEP 786432:ZCEAeL9rK8mW3bYjajwWbXU/j2+kXdBhWri7Pk2qP3:RAeL9OdwY+jU/K+kXuf2qP
- TLSH
  T15487333F39438130D5997DB90926236D8A665C60C2380E47EBE93F1F05B53CAA7B93D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  LOQUENDO TTS DIRECTOR/AutoPlay/Docs/Engine.exe
- Size 14.8MB
- SHA256 2bcaaae78e79d37e344760e51b3fabde018101ffabb2505daf47c5d5a35191ba
- MD5 19c968b35da20bf0acc3a00bc11e0132
- SHA1 6336bf10960f8c8db4206d570ed65e7b15cc1742
- SHA512 37d6c31ac9f94d97101868ce47e2697e1d8b1fe2bd3f67862fb8ef8efd10f86a9abc631bd8895061c28b060d4a7b691797f7c12cc846d79a52bb6c14a3aa23d6
- SSDEEP 393216:SA0TTnrZru9s8Gnj1aoE4s8Gnj1aoEfP05wUjVG7h:Svnr9us8EMoE4s8EMoEfP0SJ7
- TLSH
  T102F63347BE55C231E04A5A3EEC868BAC86227C96DF31A00337A43BCF36B61D55C753A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  LOQUENDO TTS DIRECTOR/AutoPlay/Docs/Jorge.exe
- Size 32.2MB
- SHA256 5a69d87fcbd19d971567d874e7bee557fdc428340fe157b9dbf242c2a5e16a94
- MD5 3e868ef265cac52a86bacecf9f33576e
- SHA1 eb6bf12c9275bf164f3fc8a246bf800e6a81a709
- SHA512 126313b5134e3c1e19d9ead8f50be880fb3be4f0fa0c472f81640b8d4ce4f15e49b733f0f35fb78f237387e80d370ed94875171f1bb7692d0988fa52080a91b5
- SSDEEP 786432:2yar6S7OdP9u3hUm9Tuk+YE9HZsM3tW9mD1RDNxt8S1WcwI:16JGpk+YxQW9mD1RDNjZf
- TLSH
  T1507733192A8AC6B5F647B63E0C3B2B7D0BF36C50CAB4478F97C27D1D53391A1A2B0945
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  LOQUENDO TTS DIRECTOR/AutoPlay/Docs/Patch.exe
- Size 402KB
- SHA256 3d659b3a032fc9a9159cdc25eb1f887e9c6c5447834dc088b063feb0d0f79538
- MD5 321e5b68fe3d5be7826e49c9bfd284f6
- SHA1 80c9a6d77fd25da26a86952a5e6b2104cc768ce8
- SHA512 76963ae4cf5c21929b6737b0a92d76e89d5a3d8490013d27aa6b6d64414eb83b4166d8bf2874609b373d9bb2581b5f34f01dc30aa95d1d90fa3b708608cb5450
- SSDEEP 12288:Lm0xFcvXi7DwXp6BVEtIv45YJlVtSPEkwOrRA:asiv4wXps6tIvZPO1
- TLSH
  T1E9947E26F6E08437C2632A389C5B57A4E839BE503D296C873BF81D4C4F7978139692D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  LOQUENDO TTS DIRECTOR/AutoPlay/Docs/SDK.exe
- Size 28.7MB
- SHA256 59a9d119c6a42d9cc48a8328c2b993d0ef3ca66f7600cf7501247fa54623c879
- MD5 8cb51ae1b11f5c271953ae8d0651aaad
- SHA1 d5edda12c2d7754470f0310db9e456e5f4e84f9c
- SHA512 b705e6c08d8d097a87438be36dc5c5918a4f9ece20850d6fa162cd5ad664dbd7f5c9153c1a2513d70fe037780e86753b5f3097c5677ed50c40c128878a67a42e
- SSDEEP 786432:d/yhIPxBdP6aGbh1a3eYh76NxvsNoVgwqhIu1wm:9iIPhP6fNueYh7YkoVgn+sX
- TLSH
  T1ED673352A0011B71D74BA43688461FBD4E777E87C9A2962733B8F25C9D797C1E2B10CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  LOQUENDO TTS DIRECTOR/AutoPlay/Docs/Soledad.exe
- Size 37.0MB
- SHA256 93658212a7242e98129da8bed739c37b3d4ec56acad66e83cef3a958b89ff364
- MD5 4549dc712ce397e100ecf8c1da67796d
- SHA1 98e274e0e8a8c00eac3ef389fd12e5556deba8a4
- SHA512 8e88fccc32791bafc8bc8abbef55eaac0e066d1c7c7f180f4b6305368a8ff60bbd238057f99b48c921c4cf128b93314ce740326b0c1365eaff28c420723a6492
- SSDEEP 786432:og+QLNYX+M/EqiHEF1qMq/Ye/LfDwFL+u636cY1OJStWPjPL2chxVw:HLXM30q1qvYYL0636cY1eStW32cN
- TLSH
  T14587335A79CBC1B1DAC53AB40C379B7481AABE9188354DA352A67F0FF47239035732D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  LOQUENDO TTS DIRECTOR/AutoPlay/Docs/Spanish.exe
- Size 2.2MB
- SHA256 4d599c0470dff1b3bcc048d05b6c8501b45cbfd14237620c2cc367b11667a5a0
- MD5 de7d84f5fe0324b322dab057918e1e07
- SHA1 6f261d3eeba103ceb2fd3be83c91d1e9006a3c8e
- SHA512 5f6364c66726354c8a300cda3ce1d447e2bbf9dcb21fdde61e9d97c9e4cd3dfe2148b692ae7dadd593f49d9fdf899f10958a861d84c44b0b6e47d4e7a3443706
- SSDEEP 24576:hvGfC4sXKyfOMzpZYj8kufL4VYBxhvLcAWoEKqc7IqXo/0b704LRYzJec:hvyCRjZYA4VKx9TSKqIIqYsb7vy
- TLSH
  T186B5010777C2C771D94B12718A1B937A4A72DC248F314E4337A87F0D3A712E5A6B62DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  LOQUENDO TTS DIRECTOR/AutoPlay/Docs/spchapi.exe
- Size 752KB
- SHA256 ec385baa8011c7b23b5ab8947f109b8e298f6adf0fa3b9eb6803db8d020afa2b
- MD5 b527096c844e4f54efc794cf306d84aa
- SHA1 0ac9856cca0e51aa8b7b82600266a9e7863753e1
- SHA512 b71b8a15f63081d17b06930eead27a7f13ded52b1a62bcaf54f3d8982bd370a083ff8f371a514795c6c8c4ded3a7173e90eecd56da9156a1b6d0039b36a9dbae
- SSDEEP 12288:PCwEWTcBoQfTpGyaQgmYbsWE3J1LxrDXSeGWcLLXEUzlamHVl8UzdXZ8EHF:PcnoUTpGyaDmCsl7pCfWcLLXEIvKg3
- TLSH
  T139F412525AE3857BEAF167B40AF006A36F737CA04FB9E74E6281D46D1D33440A934367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  LOQUENDO TTS DIRECTOR/AutoPlay/Plugins/IRDissolveTransition.tns
- Size 136KB
- SHA256 6315b5d1869c3b4cbcbead77ad63da3a60d86ede287eccef338f74178ec181f2
- MD5 6a9b0ab9341ac4204aafc7fac9872962
- SHA1 dc6ceafcb39b7329552d0883f2c3284dddbb0ddc
- SHA512 76bacf1de5ac883bb47ae8d3299d5f399ae84bcd19eadc3fd8ee01ae2605bbbbddd6aacf7fdec490b8e6baf362ae05dbf972a5710c2bc732e8542a1c5d04bca6
- SSDEEP 3072:KhIZpL8ZJlIIA2q50tluJ3Z1LAKxorjZsS/kRInmE:7pIA2w9ZLtuyS/z
- TLSH
  T149D34B0232F581BAE2EE563D0E716B3597BBB860CEF14A5B6F50974D4D31B418E26323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  LOQUENDO TTS DIRECTOR/Loquendo7.exe
- Size 2.5MB
- SHA256 3609be83373c61767984029c6d0b62dc2d278f7588f40267b4aee4ef2df0dc8e
- MD5 0a646a46919a33d23ab8c3c2803c6147
- SHA1 b85b0b7dc11e6ae6dc85af66d73111ea260b2bd7
- SHA512 f6d07aba1166a96c86588eb29cf91df8c66c68a5877b984e0824dee46f7b03636318731991c9129264a4481ba2691aa2ae290a1fa728b7059762a856d1eb79c8
- SSDEEP 49152:s/wcIeK1Y5wpVPpxTKCfrz9bXNrcTjAx:sxIh1ywpVRxTBjzZd0
- TLSH
  T14BC56D01B6D580B7C9A7023055A66735AA76DA493731CFC7A358FE7C3931BC0683B29E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Checks computer location settings

Enumerates connected drives

Checks computer location settings

Loads dropped DLL

Drops desktop.ini file(s)

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Checks computer location settings

Enumerates connected drives

Checks computer location settings

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Checks computer location settings

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Checks computer location settings

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Loads dropped DLL

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22