015424e7398f3eee03832b8ca6fe16d0047053e9532207a8f20d2855c7727377

Sharing

Copy URL Twitter E-mail

General

Target
nun-massacre-definitive-edition-windows-2022.06.08.zip
Size 226.7MB
Sample260624-w71dmaex4s
SHA256 015424e7398f3eee03832b8ca6fe16d0047053e9532207a8f20d2855c7727377
MD5 24defd9e66bfcc80ef6548f9f5765cb6
SHA1 273e37067076d1094e4f0a3399b061c356ad785c
SHA512 b625f97ac0102afa4e06b724b48da1d88c4c6c4efb8bd05ddd964523c853e74dcfe0358714a759ee9429b44006d964263afc7a876a441cc0495226a158904261
SSDEEP 6291456:Dp2wvvqWpsAjSv3aG0xu4foAozJSaSjTbi8Mub/Vs6wIzWU9XIGuMa:DpfvZXjSyGwwJJSaSjTbi8HSTHU9YGk
TLSH
T1B5B83387B3BE4F0ED9ED787B467E1E07EA0360B48FD069C02615E2CD1D42899295B7C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  nun-massacre-definitive-edition-windows-2022.06.08.zip
- Size 226.7MB
- SHA256 015424e7398f3eee03832b8ca6fe16d0047053e9532207a8f20d2855c7727377
- MD5 24defd9e66bfcc80ef6548f9f5765cb6
- SHA1 273e37067076d1094e4f0a3399b061c356ad785c
- SHA512 b625f97ac0102afa4e06b724b48da1d88c4c6c4efb8bd05ddd964523c853e74dcfe0358714a759ee9429b44006d964263afc7a876a441cc0495226a158904261
- SSDEEP 6291456:Dp2wvvqWpsAjSv3aG0xu4foAozJSaSjTbi8Mub/Vs6wIzWU9XIGuMa:DpfvZXjSyGwwJJSaSjTbi8HSTHU9YGk
- TLSH
  T1B5B83387B3BE4F0ED9ED787B467E1E07EA0360B48FD069C02615E2CD1D42899295B7C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Nun Massacre Definitive Edition (Windows) 2022.06.08/MonoBleedingEdge/etc/mono/4.0/DefaultWsdlHelpGenerator.aspx
- Size 59KB
- SHA256 751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
- MD5 f7be9f1841ff92f9d4040aed832e0c79
- SHA1 b3e4b508aab3cf201c06892713b43ddb0c43b7ae
- SHA512 380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
- SSDEEP 768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw
- TLSH
  T18C43C4A0EE5C8D36499B52D9F48140DCB9BCC43191299CF3FCDDA12AF09CC6DA278676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Nun Massacre Definitive Edition (Windows) 2022.06.08/MonoBleedingEdge/etc/mono/4.5/DefaultWsdlHelpGenerator.aspx
- Size 59KB
- SHA256 751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
- MD5 f7be9f1841ff92f9d4040aed832e0c79
- SHA1 b3e4b508aab3cf201c06892713b43ddb0c43b7ae
- SHA512 380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
- SSDEEP 768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw
- TLSH
  T18C43C4A0EE5C8D36499B52D9F48140DCB9BCC43191299CF3FCDDA12AF09CC6DA278676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Nun Massacre Definitive Edition (Windows) 2022.06.08/Nun Massacre.exe
- Size 638KB
- SHA256 a84ae0a3a7f881055cbc1c763ba876aa7c0be30ae798914d7568b2bac73fd8bc
- MD5 d98f92016eb49a45a15717be5b5d0d35
- SHA1 76e8e5fe84ab53fc2031a5120e54f0bbc573219d
- SHA512 7db300dcd29427c0ec135aa5faaa1ad4f2d0fc94652004de5e86e25f44f06aa833fbb93a3bf8c3e12a0035d0124bf22e610fb06383ee3b0348f3bcc3e3d0fd46
- SSDEEP 6144:OpC62lkCMUeG5gsnsWzmu+xiwZ1+0Yt1RvptNlVoIlEK+he2kQG6itm8x5T:O4eCXbnZwi0CtNlaCEKnGi95T
- TLSH
  T177D4B246330417ABC4176B3C8461FB7A06B25EF5AA30EB6698F0BDA33DB5E930C585D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
behavioral7 behavioral8
- Target
  Nun Massacre Definitive Edition (Windows) 2022.06.08/Nun Massacre_Data/Managed/Assembly-CSharp-firstpass.dll
- Size 867KB
- SHA256 8268e8e503ff8d7d68efecd8d3882c429703d6ead2410ddfcca5d7d706487251
- MD5 6d6b8a0f4a6a7abdccae70ad791051ba
- SHA1 f7b1f3b833030f1160874d5b345d838c9f41c12d
- SHA512 769f9505417e86402d2d8a456c482e682fcf31646755935286f63e4bb8a495399e5ed082f382355c55656e2d75a51ba7123971301c889889513ad46b7d87c7c8
- SSDEEP 24576:qNYOzYOBn/LxY6C7S8LGfkMk/H2X7F0oS3Q:BXm8ak/H2X7F0oS3Q
- TLSH
  T104153A5137F45A37E9BF17BE94750A10A3B1D596A273E78D2E81F0AC1C92B608D027E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Nun Massacre Definitive Edition (Windows) 2022.06.08/Nun Massacre_Data/Managed/Assembly-CSharp.dll
- Size 2.7MB
- SHA256 0132e2e1556cdd8026eb42a08774cfeb94e313c4e29d40cfe640c8fc5fa0e871
- MD5 fa4a320341d78d50aecc0002752e3fbf
- SHA1 50ff7ed4b6bc7573a94e097ef34705ddcc4660a0
- SHA512 9723642b4038df506d0d6a8105f831f7e1536402ee72cb2338a3d18dc624a5eb56c2336b23cdc7918b2f5b9f91569afcf3fa0acab65ac1da5e2351541281caf5
- SSDEEP 49152:/KrVlTw/LpC9BJWZBvTFfCL+ZjvOXOmjw2g2ZNX42mxRTxIu:QVlJHMvcYOg
- TLSH
  T1D5D55C91B3BC9E37D57F137BE56107016370D94AA7A2E78E1588E2F83C92B50E846363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Nun Massacre Definitive Edition (Windows) 2022.06.08/Nun Massacre_Data/Managed/CTCommon.dll
- Size 29KB
- SHA256 fcd31ef253fcc46d39d9f98f59d31f1ef509fdbc55fca0968d49321d209deae1
- MD5 fa3da413aa5494bc571de2f8bf85bb0d
- SHA1 ba8dffaa95a559e2488624f7406355707b507451
- SHA512 b254616b4274636fa326493cc616690e2628fb82d1ebc6e32513303bbdcb56ed07091efd46144d9cfdc3024dde1f37ba16cceac60df4869db534050bae4b1150
- SSDEEP 768:JxC+V6BcI5G5hfD+sGFuKlFx0XA10GDG6Kg9:JxC+V0cDqs9K9VSEL
- TLSH
  T113D25C2073E88927DBBF0FFD78F05111AB72B312DD62CBEA499CD0981E9578155213AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Nun Massacre Definitive Edition (Windows) 2022.06.08/Nun Massacre_Data/Managed/ConsoleUtilsImport.dll
- Size 29KB
- SHA256 b34aceaf8e41711adbe9b58b1a90d865773a4438d0da9fb09486282263d68e2e
- MD5 f23bb1055ca4cf24ac78c31e06590f71
- SHA1 797422f36b67b7eddb1acdcf7c0edd77a6c7c73f
- SHA512 9284faaba52db95d343b4d3c225c418047e19c82aa5964e43b86e252a0c0dec5350922f5378a59928253b05d4bf460adbad9599c0eea22c8f5cefb2f3bb5789e
- SSDEEP 768:rTw6yhOf+ogcGRFZvNx/QxzncZZ5dXnzLkI4NWK3KEoP0VILj:rElj/83KE/+j
- TLSH
  T1D6D20A41CB418729C7DF37F168570B488BB4E284E927EB0B5DB905E5392BF904B482EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Nun Massacre Definitive Edition (Windows) 2022.06.08/Nun Massacre_Data/Managed/DOTween.dll
- Size 158KB
- SHA256 48ea88b9fc7d95fc04ae333e7df4fdeed865ec39629382e5524f5cdc32e7dd4e
- MD5 b0c92c3bbe4adc4881598bd16c5c0202
- SHA1 1389b9c2c30a4cf013e3109a670af53f1b292dd3
- SHA512 445d4896ab729777c0f32dc37ff67991b8847bbab36b849fdc8146ec883b050791f076dbd0dea55215901d9c2c876b8bcef269f087d9a15de70bf2ea8ff5054c
- SSDEEP 3072:wmJuRf6eC3QaWnGpRXrfVvLyNXfFoldyFi:wJRfdLno5DVvLndE
- TLSH
  T127F34C0897F92632CFEF0BBBA06C1909D235E40F94B7E7EA5D0990F92857395A9013D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Nun Massacre Definitive Edition (Windows) 2022.06.08/Nun Massacre_Data/Managed/DOTweenPro.dll
- Size 15KB
- SHA256 86f3a360aca677b54b14fc489b8dbbce08cff5a88265ad8b57b88f16a90db1ff
- MD5 766265f0e8de06b2e815ef65367bc924
- SHA1 b4ddc454a025d875fe79f2b39e88c4d5829a8f87
- SHA512 f927bc6a3ec07f0eaf5ee6a1c41a4df7796654eff2aec9bcfb920b8e4e1256d508a9300af2fd6f49de56646260f918a84fdd81f420bd49fcaa37d562a0e62d17
- SSDEEP 384:WRVNG5YH4TZ2TWA6D6SIbRIL7QL9o4kZlVP:eVNG5YeZOWAE6bY7q1wld
- TLSH
  T139620A6177A88233CAAE4FBE3D332B400374FA079952DBDD2858A8D929077C155E1B97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Nun Massacre Definitive Edition (Windows) 2022.06.08/Nun Massacre_Data/Managed/DataPlatformImport.dll
- Size 70KB
- SHA256 d5a7737c247f82c8b276877f91e4bd307a57b4e85ae1c857b510986ed0c73ed9
- MD5 a0ab69033ae27d801da49f09f7b1ad5e
- SHA1 2cc268601f274b1cf1431910058b7fd72df29bfc
- SHA512 e846c8b1b2da4a5c9178efd7974f3fb3bc9f31bb562bec18d32d0752aab84ba68c4f6608e3d721facd781ccbccc7c2f7f895a6ee86aafd8691d856388240c813
- SSDEEP 1536:iDmExzJ3iSj9VE8BHlVxlDajqtmybACDy1/k5iLYahulypAcIAcLkv:SmaxgcDy1/k5iLYahulypAcI3Qv
- TLSH
  T10463F771A3D90632E7FF6B3BD5A50B117772B581B132D319C69AC06928B3F8166123E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Nun Massacre Definitive Edition (Windows) 2022.06.08/Nun Massacre_Data/Managed/DemiLib.dll
- Size 11KB
- SHA256 8ce13f114ae918462df3f41661a6636b89751bb993d57b9a18f736ca3525cd4e
- MD5 8bf0d0f9083c59939e129f7d82b749ee
- SHA1 2f33fb874d6852fcc8d3765f259859cbe1df6932
- SHA512 c398933444aa55c7edafcbe58b69248179ae9d6084e27021fd6359e2a77a9aa4d083642fac544d8997882f374d4eab01b5ea80c1165d32af45c8436b059ee07b
- SSDEEP 192:AF0axhgj2fMIiqA0z0McehTzmluh7Y4f5MLHwY0PnPFm:A1x43PNgTClw75aLHw5n9m
- TLSH
  T18032F820D7DCEB3BCEFF1A7C58EA4B411231AA96952BD34F0589A1275803B981DD27D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Nun Massacre Definitive Edition (Windows) 2022.06.08/Nun Massacre_Data/Managed/EasyRoads3D.dll
- Size 153KB
- SHA256 430073c496e6a2b15398466d9657ed381d2e29460f4a4dff013f1bdca62f3a04
- MD5 29d6bd3194ce4e59af502e5f93cd89d2
- SHA1 0e99ada2f5b89bbb751db038cf564eb0aaa8b9de
- SHA512 22aa0e42bbb85655bb98bbfb30ccdf7dc7316f1a155104c81fa0fd3bd551b095df87d70cc79f7207e20c6e15f1044c8088b30b121a023cdaeafd5affcb4fe6cf
- SSDEEP 3072:yhaEDaE2g7w3WNAocoLP8d6wLu1Rw61P7/9Ulz:yhjaEK35oc+Rwo7/9e
- TLSH
  T1A3E3E56C6BACCB22D47E07FF61652645D3B181A6D29AF39E4CC278E71D667C089093C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Nun Massacre Definitive Edition (Windows) 2022.06.08/Nun Massacre_Data/Managed/GamepadImport.dll
- Size 4KB
- SHA256 b94334953bd14ca8ba3c55a5e4c4a6386d044658e90ba265930bd46c693ceb02
- MD5 0fcc4c258524ec5bdf9913e7de61d9a8
- SHA1 80116cd186a2e4f8fc325c329bb9ff74302e19f0
- SHA512 94afe5a527cb1046cda6699c3b38a7fdd6a21de4100fbbe01bd2e47cd963e274d5eeb49e1120a79806ca5b755358a81c5d83b65862037d4e0a4f80e1dff3da0b
- SSDEEP 48:6D+l4gl+CtXw2mJMMhQZYYMGQshd1trUlaZg4F:J48tg2XZYYMDsZ
- TLSH
  T168913211A7E44337EC374F36AC634B8252B8FB509AA39F6F05C5622B6D273610D32B25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  Nun Massacre Definitive Edition (Windows) 2022.06.08/Nun Massacre_Data/Managed/KdTreeLib.dll
- Size 18KB
- SHA256 5d8a6cb6a74cc7249d98a2380f17befe1dd108f8919b8e690cbf2ca4d03a50cb
- MD5 5210613f42235400b9cb3127eedaf390
- SHA1 f67d466a0c2df08b72ead5734bb0140ca2974a9b
- SHA512 4fcc22e1b804a3f5272bc97fabbefe41cba6867f0b37b7a928a44262c83f5c32b4f785e41752869bc1acba9863621f79fb98648a433ba57506dd383a66c69833
- SSDEEP 384:gvyDloC6lQrLBV5XkMKq+hiRny0FMXNYQRqjRtSN6462:kyDTBVbKFAEZN6t2
- TLSH
  T1BC82E7097BEE8353DABE2ABFB9B042F48374CA557903E75F09DC65BA4C437004A88365
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Nun Massacre Definitive Edition (Windows) 2022.06.08/Nun Massacre_Data/Managed/MarketplaceImport.dll
- Size 38KB
- SHA256 9de21906e35de399aa86282b6e17f37e919d2597434c149850f9fc637d0b31be
- MD5 7e548e2a2b609cabd43be0e1d706c66c
- SHA1 2f7259196f24ee82c1795d6ce51c50825309d8a9
- SHA512 88b019864fbd0f64c3788bd677f20c29538102d6685942640a2028038a2b6d3fe20cdca12b35b8730998bc35fd3d89f7be23650ce8c95075b404652d121bd1e3
- SSDEEP 768:npfMh87XQkhPKVxlYFrA01L2+45GUICOo0hQiWZvTu7+8j:npfMh8jQkho4Ud5GmAKZvaCS
- TLSH
  T14903D6508764431AD78D457E70F60B107BB4E4CA1B27CB252ADFA5463E63BE02E227DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32