8369154755c31bc07ac80ef2d44a7721cd04fb87f4b4082d0f062a92ffe85987

Sharing

Copy URL Twitter E-mail

General

Target
DELTARUNE.Chapter.5.zip
Size 717.9MB
Sample260625-qmd21act2x
SHA256 8369154755c31bc07ac80ef2d44a7721cd04fb87f4b4082d0f062a92ffe85987
MD5 ea97024863d5894fe829e8782ef93a0e
SHA1 3dfff275ff666f8681d14a8b26523e0c12d3b8d9
SHA512 378db61efe4c97ef72ca8284d92516bdb6f5626928c26ec5d41da25860ab37c6a7e7a6b56cd524f4ec6217d33c3196ee749820bbaa1abaa2ad8e1c6933fa05df
SSDEEP 12582912:5JB1j2+dTzQ6C5iMdVPI+2McnbVgdLeefl29BWMmYTZN6cOfxRSgcPAHc90X/YkG:5JBFd/3ClVtFAbVgdLGWQZf3gcPA7X/W
TLSH
T150793349D6B4650CC87BF97DA6B22A0616D8810EC0874DB6F33B49D88AC77D2727E74C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  DELTARUNE.Chapter.5.zip
- Size 717.9MB
- SHA256 8369154755c31bc07ac80ef2d44a7721cd04fb87f4b4082d0f062a92ffe85987
- MD5 ea97024863d5894fe829e8782ef93a0e
- SHA1 3dfff275ff666f8681d14a8b26523e0c12d3b8d9
- SHA512 378db61efe4c97ef72ca8284d92516bdb6f5626928c26ec5d41da25860ab37c6a7e7a6b56cd524f4ec6217d33c3196ee749820bbaa1abaa2ad8e1c6933fa05df
- SSDEEP 12582912:5JB1j2+dTzQ6C5iMdVPI+2McnbVgdLeefl29BWMmYTZN6cOfxRSgcPAHc90X/YkG:5JBFd/3ClVtFAbVgdLGWQZf3gcPA7X/W
- TLSH
  T150793349D6B4650CC87BF97DA6B22A0616D8810EC0874DB6F33B49D88AC77D2727E74C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  DELTARUNE.Chapter.5/DELTARUNE.Chapter.5/mus/nightmare_nes.ogg
- Size 39KB
- SHA256 897a6e5928253c2cb59e5a6fc889f0f9ebbde1e8e2a42cdb47d2c556e1d579e9
- MD5 f4096e53aecb58f8cce278e862780c40
- SHA1 4b77f81447efe73ab87acdc2c51728fb520b930f
- SHA512 68f9bb260a3d0fe45df6be7af07da93341ebb8eb2dd24c38f6c8a4050bfd44c2c7591b33c72ca03678b7f81cd089a184567ac0d1f91d9d071f3a996a47263ebf
- SSDEEP 768:nFCJrv0iqkXb0S+06ZFd1R7RakvmBUV+D3khFDGDjfn1Ray5:nAzX4SHcFd1ukemV+D3uFKD7n1p
- TLSH
  T17A03E1033F75E1CCEC4130B99AF7D00A3AF87465F4AE8BD55A8858869C36061BFAC549
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral3 behavioral4
- Target
  DELTARUNE.Chapter.5/DELTARUNE.Chapter.5/mus/noelle.ogg
- Size 429KB
- SHA256 e88229201c37ca4ce9ca0b9efe3b37a755bb767ad59301f8c4f5f811843e774d
- MD5 1ca9c249943d2ef59c9413edba69b28d
- SHA1 790e14268a228c735aa7ea444d97a76cfc8f4238
- SHA512 ac24c37821df95614307adc73b7f550fc5a5380343eb2387732c3ebddd70b903870fc084e2601c126ad429b81c9822ead21e546df23416e331f7ad9443942058
- SSDEEP 12288:xklfTJk+quX9NcCedvvfMk1E8dnstz+e9PwAC:Ak+qSNxeNffnsJrDC
- TLSH
  T1FD942386874011B9FF0B7EB3A7280F97319852AC17AADED86D454CCC67CBE8106553AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  DELTARUNE.Chapter.5/DELTARUNE.Chapter.5/mus/noelle_distant.ogg
- Size 510KB
- SHA256 2ce98ca28f08c041640fe903a28893fe7de01110e2d3cf806168bf13be4a482d
- MD5 f08e2caff8897531128cdfb2d5e8fe71
- SHA1 4d0180f31d75244a97d880f02424a6f1854a5cb8
- SHA512 acedbf2963a2f8bae65678d83e8aa4772fed7405b32a7188f44eeafa4d134d28f80c6bafd51ce816591284168cd34db0538ad8406854496f6786a59d8d5d96f1
- SSDEEP 12288:Xeo7e/8Hqasn97rRvDdqbMp8W13vXsQgX4IokUKQv/l:XFDqv93pZqgp8W9wIIokUKQv/l
- TLSH
  T171B423563E44BF9BCD59D672F2672AB2421E49EFCFF116A10F7A04DD1CB878A2843810
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral7 behavioral8
- Target
  DELTARUNE.Chapter.5/DELTARUNE.Chapter.5/mus/noelle_ferriswheel.ogg
- Size 1.3MB
- SHA256 ed403f25bf26bb2d6cef15e0fb860894e160622281d3ce1bb26c7b1f21b4d074
- MD5 3b3ea55e36bf2377e843d7190e5addb6
- SHA1 2a033f1f2f3c3b665f5ac44b9d62a5e6fcb25efc
- SHA512 63a681f6959c52aba707e7f4f3fcef6df8edc5c75eceeac95382f5a3e9afefa9994e0c97bc2e06dedf1a4d2009c5daada9c2f9e0ac20bd0c35087b32706d7562
- SSDEEP 24576:5GElBh6Wuajk5MDwfLA1SMdJXxq4q7Q+ksLdOBcVy/9Mt2bsmJXf/Cm+Uuf:5GExNOlHE6xABcVFIbdX
- TLSH
  T180551252DE441ED6C8AC1A30858B5F0C73B9D96D97C26B0B873604BD6EAB7D8EC07D09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  DELTARUNE.Chapter.5/DELTARUNE.Chapter.5/mus/noelle_house_wip.ogg
- Size 1.0MB
- SHA256 e4f6d37414bed437ea19906111b17e5a2b7ee042c3886f363c49c9e21c7277f5
- MD5 32713b9da19e25bce92e78a7fa01667a
- SHA1 4b82e5624ed97755441db985a9c8c18af03a1d9d
- SHA512 1a8ad29013225e627bb1d37b64625761dd2b8e63e5240b6282b2738f13a841b03097c21b3c5fe2fff249b22f33f01d6d11ddca8668c42b05e2da330682c4752d
- SSDEEP 24576:ZmhTHK6ePw1mBt/xspD2n/aKr7ysm10Ak5orBeLRMkA:+Hvez+D2ntQ1j7gtMkA
- TLSH
  T13035238B2EA10CE1D99DBBFBC16B01539BAF613DA3982AD2C3C47757DD44D1478048AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral11 behavioral12
- Target
  DELTARUNE.Chapter.5/DELTARUNE.Chapter.5/mus/noelle_normal.ogg
- Size 1.1MB
- SHA256 ada7b196658c1949987b63149793d44eda2ec8448a7b79f3a54d07bfe175d700
- MD5 e104d7d8c65fd26cf9dccf797f5358a7
- SHA1 18db46043bf9672a47d0c225ad52fea065a951cd
- SHA512 86de3710dbf5af4d80a1963ead74239e6a9c039b145dcf778157f6b4cf41e6d774648769cb69ca299373240eabf004adb3b7ff2f831f23b3a0f417c6f4683d71
- SSDEEP 24576:w4QEsVzZyIdWw4xXGMkIzsbogYYomt6hxRq+5u:5QEsryyWkMTzngT4M
- TLSH
  T16D35225AFE865DCBC09824B185FB1F1C73B8E4756B46CA134E2815AA0DFBB49CE0750B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral13 behavioral14
- Target
  DELTARUNE.Chapter.5/DELTARUNE.Chapter.5/mus/noelle_school.ogg
- Size 430KB
- SHA256 a806c14cfbfc1e5847f904e5186bb1942752461a1d09258063f673fb8104f62d
- MD5 d85a77183447fdd6019f77af480a4530
- SHA1 e0e9d48b76594a7ace6fcc47a03b443794fdaebb
- SHA512 db4e21a3d39ee5eb38fe0b678e3f53d76d93827b294c5db59fe0c85fea0a33342a7358294779ee98a1c77cb16603bdbd67cc6bb9d7f53722fd06c1440a5af73c
- SSDEEP 12288:O57145myw+A1aM6rjay7CDGjahIR8/Bbx5Ouwk/MJ/K:O5djHgYXAk/MJS
- TLSH
  T1BE9423029BF56D87E481E8BEB5BE9C640636305CE7270BD47DD8489FAA14924CE470EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral15 behavioral16
- Target
  DELTARUNE.Chapter.5/DELTARUNE.Chapter.5/mus/noelleshouseoutside.ogg
- Size 426KB
- SHA256 f6ebaa9beb462a3301f8efa31a219d6d8a60a92d16ee2876b7b9c94514309f02
- MD5 7f568dbd7146626164ecdea89561278a
- SHA1 4e9224de1e5a901f9e67c41ec2794a0d204143d1
- SHA512 a22dbbe3cff6e76751e18890e8e7e0620979f4c9f78038162b52c5c20f848178335f4c192a24001319ff995a013f463c72b85a1d2f801ca95a0b4b21a9a08974
- SSDEEP 12288:MJznkusW25jPjunSBtii07GzLe10PoJJRF0ktV:QTk1N5jbunATlATRzX
- TLSH
  T1EC9423D6EF638C79DCA8AE3918E74D29327F177D65D556081C34CB703DB2224268B2A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral17 behavioral18
- Target
  DELTARUNE.Chapter.5/DELTARUNE.Chapter.5/mus/northernlight.ogg
- Size 68KB
- SHA256 26055e1e61254cf62b215a93e5ed82ef9e8d9d9ac0c45bb01c218578a71a6112
- MD5 307a03a62572b76f49a428ec119b546b
- SHA1 58430b2cf47e8a06387b17891b859cf866695d94
- SHA512 b5877d6879e9baf4b2f466912329f700d2c5eea070aad5e0841d536a6dceb24b507f0aa3cde750715440ad24346a56a9df499bc04823a0188d890414070ee476
- SSDEEP 1536:vISKRaMu5IjE5mRxb7kV0iWLFYKBFk0ByUjgOYuZmj43qn:ME5mLcMFYKBhjb0bn
- TLSH
  T1BE63F167E68788CAC21D04368D4B033E3B9B905EC795CF5E97D01A571CA3D3858B159F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral19 behavioral20
- Target
  DELTARUNE.Chapter.5/DELTARUNE.Chapter.5/mus/ocean.ogg
- Size 146KB
- SHA256 0035deea016fe978a5359e6c1f2b17c997e18d716e64e27669cb96d34c3480a2
- MD5 717bba27166491817c4e51c0b8913495
- SHA1 0ada120157cd8250c800bfd742ac0e4bef003222
- SHA512 1c20f7fd1e91f02bf5bea5b9f233fbfa6f6748785399084bfc853d993c6ce821a9bdf7d9066a1ff195fc2f12b4f2386d0406da41bf181aef87d0a59e8e6150dc
- SSDEEP 3072:vMOYK8O3b8fdAv09RIIkkz+/VvVBCiFoKQ25U22D1U62N5kf:5b8S8f5jIIkLUi2KQQVSU6uC
- TLSH
  T143E312648FAEC840FE1B36F0D11F0ABC6B4E2D9959E4FEC6B459B50B8AB5E0B4C454C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral21 behavioral22
- Target
  DELTARUNE.Chapter.5/DELTARUNE.Chapter.5/mus/oldman_helps_out.ogg
- Size 556KB
- SHA256 578b8d4c057b2140a28433c270ee56d3c85ecbcb9b064e8b5582693b66d59b06
- MD5 d76ff76192a4718ad9d845516646dab1
- SHA1 680b4214b2289260c6da36783a7b3d9c5504fd6f
- SHA512 af3b2f38a499007bfda7cb492b40dd1ac591cff24120184a6e8171690d03c920737ea9a7a69499ebf16d38ca001609be0c6d412e9a3777adc1e9fe9e8ccdf400
- SSDEEP 12288:EmCyaokjy189ZgCfV4ohdec/e4TipK/5BdvKlU4fiFohC7Ex1q3AF:EmC5DgKVddK4TCwxB4fiFCC7ES3y
- TLSH
  T159C42316AC2BE164F60571F3907B07E01E1FB69CA6B69EE74DDED2390B27091BD08724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral23 behavioral24
- Target
  DELTARUNE.Chapter.5/DELTARUNE.Chapter.5/mus/ominous_message.ogg
- Size 19KB
- SHA256 d52e6224dd7b35ee11622728788fb9a0ff0acd3181754e42468940d27d3ddac7
- MD5 8262bc85d3e0c09706d3b92508582a2e
- SHA1 43d1d8bd057695a3a3e4ee844ef321c8f84155d8
- SHA512 559f599c7911f61b32d6d2cacf3a6b3918e06388becf2ef4eee18b3cc19997df7683ed4ed44bbef9f146a8754a5ba1d7fc6e44f929b34c0e6829c29634ab8f25
- SSDEEP 384:cn6kvwgjNpGVY0lR9nUbFHyDlF0SlND2Zq7gNtz6:4ZiplLUb1ylOSlyqkNtz6
- TLSH
  T19892CF5736F2D022D00A0A3DF7434F1897646EBFC131D29A5A48163D9D6FD7058AD64B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral25 behavioral26
- Target
  DELTARUNE.Chapter.5/DELTARUNE.Chapter.5/mus/ominous_stab_harsh.ogg
- Size 54KB
- SHA256 bde3676f6f0cceed5e1277779c0e5bfbbf868fa83cb0c71d375a83f096a21db8
- MD5 be134132a3f08d13a16393759a66c995
- SHA1 bb45252f9a128d6fe68affed2044d2d3c2d8d8a5
- SHA512 69d368ded3a058d17ebd268629392de76cffc677ed2e127363baf9e38ab7c89c2a9e3e26a687896e6da80f2572e5ef48829d0b33826ca2aa6fda02e1fee6a535
- SSDEEP 768:dF5OIYW0+J+Xd1TQ0se7sQiCkCOuE44iV35sCa7ka0q5s/MzVwGOpJ3OuPj7q45:dF5ZYkYpse7sQnOuV5psC3UpwNvj+45
- TLSH
  T17E4301F082A1815DF95739BB33EA1CC143CE914FB3B56B9A9F646474049EC64ACDC88D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral27 behavioral28
- Target
  DELTARUNE.Chapter.5/DELTARUNE.Chapter.5/mus/ominous_stab_harsh_2.ogg
- Size 36KB
- SHA256 83598223e578fe79cf29e5b9f357d44b74f09946c016e201297d08a5bb983a1d
- MD5 15ca9c96dfa68b81062d99dab2432607
- SHA1 9e39e42def492a600a4fef7e50f1ba6bc2c9a894
- SHA512 a6b35a918a61c16164cbfaeabfa575c2a4339f1f7427292639cb356b9f0a82264534b5dbf7836182cefd50cea13688f54771cabe17659e7edd27a2050dff6876
- SSDEEP 768:iePUZ9gGlHLuoPAK+X7vBy/N2tsg7kl5mV:7UZDaOAK87sVgsg7kQ
- TLSH
  T15CF2E1828DFCC15BDD50B1F6B61D4A600700FEE259702FD9A3B70A76FDB06136D902AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral29 behavioral30
- Target
  DELTARUNE.Chapter.5/DELTARUNE.Chapter.5/mus/ominous_worse.ogg
- Size 62KB
- SHA256 2fd820d8ded220c06742705334142a8aa77a2a3edf61cf781b96450fbd477693
- MD5 5913ff49d168ff8899256eb96e8133a1
- SHA1 43d36cfa90993ae6e227672430cbaa8fc7a9af9d
- SHA512 7cc66f723cd0a296fb98c7ca0baf3d247360033296a8c6cd4dad864629bbac53ab5b97827108228847fa8f2e1fbfc260ec288150c93b63e724019f97e7cf88bc
- SSDEEP 1536:hnO2neDNO8IyekKM0q2UqI4/Tf2NGKzXa7qW4e57qFm:hO2niObRNJIET2scyh5GFm
- TLSH
  T1E35302D184CAACC6FC6D30B7865008FF06E49D426E7AB6E78A62F9F839F70684C57541
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Boot or Logon Autostart Execution: Active Setup

Checks computer location settings

Enumerates connected drives

Checks computer location settings

Boot or Logon Autostart Execution: Active Setup

Checks computer location settings

Enumerates connected drives

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32