04f78726f4b3dcf57492391515a4c609b71578b0f5b40d445df022440e48308a

Sharing

Copy URL Twitter E-mail

General

Target
Toolsrepair.exe
Size 526KB
Sample260624-tr4d8sdv31
SHA256 04f78726f4b3dcf57492391515a4c609b71578b0f5b40d445df022440e48308a
MD5 23d7d2472a1bb49316c5f40d391a330b
SHA1 8febdbc3ee0f431d855cf8861a49bb3e2e30b019
SHA512 f2364a66a85b7ea9cc909a2c334ffb11739b7eda19f2e9329d05bd624e720dbc8b76358ee88df0ae441f5be87e098e7679d1f0a96be557b83e347828c30d6a96
SSDEEP 12288:vZ2tQpzUwHAk06tSorkh8N2pVfNI241QjOuHakdYj:gupzUwHAk06tSmkhtpdy1clHamYj
TLSH
T144B41256AB88008CD5AA9B3094E4DA67C772BC552479C08F57C0FF8F2F36351AD1A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  Toolsrepair.exe
- Size 526KB
- SHA256 04f78726f4b3dcf57492391515a4c609b71578b0f5b40d445df022440e48308a
- MD5 23d7d2472a1bb49316c5f40d391a330b
- SHA1 8febdbc3ee0f431d855cf8861a49bb3e2e30b019
- SHA512 f2364a66a85b7ea9cc909a2c334ffb11739b7eda19f2e9329d05bd624e720dbc8b76358ee88df0ae441f5be87e098e7679d1f0a96be557b83e347828c30d6a96
- SSDEEP 12288:vZ2tQpzUwHAk06tSorkh8N2pVfNI241QjOuHakdYj:gupzUwHAk06tSmkhtpdy1clHamYj
- TLSH
  T144B41256AB88008CD5AA9B3094E4DA67C772BC552479C08F57C0FF8F2F36351AD1A7A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

defense_evasion
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 9d81c2e901e59350e33f0c33f44e033e727a4d962e245ecb23561da8feccdfad
- MD5 67fc1324e53b1f3854557f23b0c22654
- SHA1 d36528a0468951a90a67a8e71881eee655d65c7c
- SHA512 0fe91fd5e2267c3f21712f0a921539a13868e57e0f5444d86704a3e3ca15e383130ece5433ff9948e8772c777c401270ccfa99eab65527039333946ff662f4e4
- SSDEEP 192:K5zfH361apH705aW7DSGb6KVFEc+Js68XDEKjbR493oJZnxxYCBm9:K5zfX61apHg5a+SIJFESACGISCm9
- TLSH
  T1D4424B5AEB72207BD01385BD9795E107D335B8DA79E0974F0AE8AA3A2F137902C5434E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 10KB
- SHA256 abd16682aa1531229e5aa727dda379050f66bd788c12fe61a38551f96dfcacb5
- MD5 b9cf10930a5144fdda9479613ee3c84b
- SHA1 5110556ff6ed1559c73cdd444f6e2408db570653
- SHA512 bb9947763fea6915e90e662438d1247678576ff944f9918dcbb0c93d669f8a0dd7dd60db95f53e52faf1e0d3d627789cbcd6196441113556acaa6711b6b6f350
- SSDEEP 192:VvvwccHJBa8oStSigfl6dblJDBUorNuCjLUoaTOt37Eezqm:VvvwVPa8oStSTUDiorNRjwoT7EeWm
- TLSH
  T15C22E85BFAA4D2EEC4974136D5BB5B06CBB170125692DA4E0B3096897F233433A2D74C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 a22e9b6a0d511872cd572fe5758026a26e90ee3f19fa992a02abe4f6d34f5535
- MD5 cf0cac49c427a501d7806033941a6da1
- SHA1 92acf906cc962b7e4c4138aac8ecec67c9629b4a
- SHA512 7ad31611d7c0657d70318c16c781b7da793c8a19e4dfafcc90abcd4c8eb0dbad3aacf643b558b573502e50f504bb9f384b4df95f0db840e68763f03a7d8e85d6
- SSDEEP 96:wC66T7ItPQcwPbfTA3Ck3lKYHxFYSdt4RTUR+4nz:dT7+EEjje4
- TLSH
  T15CD1CA2AA7C102A8C82F51F0A93F4A07EBA5308125785A3F2A688C0E4F53AF1737C745
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  dwmapi.dll
- Size 132KB
- SHA256 1ce49ed63af004ad37a4d2921a5659a17001c4c0026d6245fcc0d543e9c265d0
- MD5 6ef1dc91e464e6facd41abe889e52894
- SHA1 bb080347344da6898a50a8422a2fbcb78c21aadb
- SHA512 5e97c90cbcc1e308203e3513f450f4f77783bb274a0d2c51297971972e8c99e95b578b300b7a0e111279dcc0ce95be38c36ebf662c48033b337bc2d606caf90c
- SSDEEP 3072:9l2eG723XIIc+y8FsVgqdTOCr0bhzsisAUqiXwpJUP:X2eGYYy2BOCYHynAz2
- TLSH
  T132D38D5BB7E510BBE5678A39C4834A45D772B8510BA0EBEF03B442561F233E15E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  xinput1_4.dll
- Size 657KB
- SHA256 ddb1f0909c7092f06890674f90b5d4f1198724b05b4bf1e656b4063897340243
- MD5 235ca6c1bdc287c01c7c2369d6928f28
- SHA1 2d81817fe40138d5c9ae6155bb72e2d8957335c1
- SHA512 7e487f027081600d93184a7ed3ac407ed9a81cb0f269b4a92d066c89d1e95e0678d4158a103aa153e0fe7518bd374529ac87f25c457afbd96104a5b835429e02
- SSDEEP 12288:VuigyYF+yHPJAarykqBr9rTKxXiVncYNCdJqgmF8Tcf71R:Vu7LcyHhAaTerBKxXiBREdJNmqSb
- TLSH
  T1C2E48E56B3F400B9E5A7C138CA534513E7B3B4551320ABDB07A09ABA2F23BD1673E760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12