7db5b3a1e23af39d0a648843c263eb5cf51493ccbf2a38c6a4315db80a4f9b58

Sharing

Copy URL Twitter E-mail

General

Target
ventoy-1.1.16-windows.zip
Size 15.9MB
Sample260625-th64rsdv7l
SHA256 7db5b3a1e23af39d0a648843c263eb5cf51493ccbf2a38c6a4315db80a4f9b58
MD5 91d9a2fee439ea6ad334942344f4ab1c
SHA1 6c6f18e426f5ec09ea41c4485bf2d5b101c2792c
SHA512 b5aa55722bd0189a6dcb37718ebff5b27626428a82479555a6dbe1a8a895e641d9539838967ce6d51023f93f8403e34f0d6493aef3e749fd47850bd1b1b64796
SSDEEP 393216:F5NL4MwH8Lmrb5b5gQu08N9Oeifc8wxcZRq5fKtdiz:F5V9wTrb5578yei0lxcnSz
TLSH
T194F63396FB65628CCCD9372E22FB0C18F0EBA3D1F2ED381852A44EDC677D1458664639
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ventoy-1.1.16/Ventoy2Disk.exe
- Size 589KB
- SHA256 aa194a077ff8b57db01ce51cf492201f708e66d89535e80df2748eb13f86b951
- MD5 5a464d46ed6fa972f06fccde50b835cf
- SHA1 98bd602b66b7afad67e721d6c77b192cfdb33814
- SHA512 1feaeb536e71fa123f170dff5c27331ad14f1e5ecbde4dc203d104e59ba7ee6621c578966280fa37a6be59c6c8bb315a5741ae5a93483b45f85408de0f734d21
- SSDEEP 6144:ZKCgQlPMiyBjafBILI89nc78GVX7Yd7V4/3gUs/DbVao4qqPIBXtHSWENLVxORtH:kCTl8afBILlnj4YnVWqqPIBONhxsUe3
- TLSH
  T11AD4D5E16240F55FF2C09A336FD88B721939F92DC9CA915767802FAA59310F26736633
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral1 behavioral2
- Target
  ventoy-1.1.16/VentoyPlugson.exe
- Size 364KB
- SHA256 192c66adeede58f871f5200bb7afd0579ce2dc1a42425342a1d0c645769b32d3
- MD5 ece63abf1708b4a29df4caa946b382bf
- SHA1 b8117d90a4473114d7feebba2031174881d949f8
- SHA512 d1d815a01983f40fa360e1c7f9c054d0354640d0cfe73165e120eadfdea48a8f9419876b817bc7101f7eadcf789739b5f431d7aadd9ce4edae33e59162bfa804
- SSDEEP 6144:ChCNnXXVDa1eaWFzhAbQA7uCfzYOO2xltdlaA6ypj4nmJPYts0FXLb7UHiEneCcB:Ch8n1Da1zWFzhAbQA7uCfzYOO2xltdls
- TLSH
  T1B4847C11F840E032D5A20570E6A5DAF3492CAD71EB1594C7F3D07DBA7A309E1A73DB2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  ventoy-1.1.16/VentoyVlnk.exe
- Size 148KB
- SHA256 fcfaa10af53eebef4a986b002006a7acf7af9c2465caed7e37edab9626bcfc4d
- MD5 8e84aa749ac62d5dceb600cec8d86c96
- SHA1 3a224340c4e361b2383e96ad86f2d515f40f7d8f
- SHA512 8cda75b9954ffc3df9f0b9f00b943372a6be5637603ef392959439f0509662832b7ff73aea5cac1afaa2d76281b23f85c5d2a99d6e92f8c1fe9253598a8dbf1a
- SSDEEP 3072:l8nH9j2ziuvAaIBlCn24Rc4Yn0NJKckH2Fe7E29A/zdGt69heo4J:lyR2zi7ajvRcGLKZH2FaLw9hH4J
- TLSH
  T1F3E39D5579C1C072E8B328312970D7B15E3DFD301F609AABA74816799E306E0AA35F7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  ventoy-1.1.16/altexe/Ventoy2Disk_ARM.exe
- Size 564KB
- SHA256 ba01004c0adfc984fc4cd5741b6d8e0bb5ec035b7897726a0f450187094b30d2
- MD5 3ef7a218a214a3c082fd1eec85607a26
- SHA1 b878bed8f71657e088fb9a6d6994c4606c35040e
- SHA512 e645d50687a4517ab141baf04d7cba41ff0acf0ff6412ec8deade899cb14605aef5a94a0c0ebcef9ba97cf9e0540ca9e755245802b67d434e99effae6e62b1bd
- SSDEEP 12288:A1y+DTAP/3HoSJpInVWqqPIBONhxsUmxuy:AANwSJV/xsUmxN
- TLSH
  T1CBC4F7F96390FA5FF2C19A73AFD88A210971F95DC4CA91171A402BAE58724F61733633
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  ventoy-1.1.16/altexe/Ventoy2Disk_ARM64.exe
- Size 624KB
- SHA256 ea3a20b97ae44a42b4d6b6a79f7999b0ddc8837cfe6e3aa5203c5cd0fa75c8ec
- MD5 a04080599309cfa6d95543d184716c95
- SHA1 a3767bf924c9883d20b94c18061f74f52421db71
- SHA512 4f52d2037f1a89541909e0413d625b825c57a8c21017ddf117065964ab602571a9996d7121565b9b664b4db3570aa650588a90796ad2459d243a73a863518af7
- SSDEEP 12288:6lhltVHZB08UgR4rkKnVWqqPIBONhxsUs:0lr08rRmO/xsUs
- TLSH
  T144D4E6E06644F98FF2D0CB77AFD88E212936F95CC4DA900722112B9D98369F66772173
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  ventoy-1.1.16/altexe/Ventoy2Disk_X64.exe
- Size 633KB
- SHA256 c459f07605e3e727cbaa7829d3118db6a03f035647ec0e6d7aa470ce46497288
- MD5 6767aaf12c74283d4dcd853f0ce2c4a4
- SHA1 695c65c680fa7b0616212b9b639f622d914cbd56
- SHA512 007d95f501d6cad1cb857b0ce8aced48cb36d03ae53d974150cec5be2617db7df2c5d9e43bbe4b7803104eb2aa3bf1d02825937c9ea183e821a087636a909105
- SSDEEP 12288:+7bo5HNRrENMzYLVU2dnVWqqPIBONhxsUo:IotNRrOLVvg/xsUo
- TLSH
  T1EED408F56390F99FF1C186379FC88A225A32F85DC6CA915B16506B5A2E331F12736233
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral11 behavioral12
- Target
  ventoy-1.1.16/altexe/VentoyPlugson_X64.exe
- Size 450KB
- SHA256 b238272053496f66c06fa570730459e432c8ec62a72eed2971d113459ae2e114
- MD5 8c30778eabf464f38e59339117491213
- SHA1 b8e86cd61851fed735459593660b654bce4f8a40
- SHA512 ea4d8dd3d6aa01bdf7e4a2448368e2e2a6e604abddcafd580fdb2b8a0dea273361de4db36b311e946787cc3370f02c93a68aca55c792633a0be7b251f2b0a9b9
- SSDEEP 12288:RCiSS4Sq7TP48KJFbB5i0ZzVKzy/mJQCg+:4O4SyIbB5iIVKy/mJQCL
- TLSH
  T1F8A47B5563A484F8E5678238C55359B3FAB17C519320DADB0398FE363F33AA01E3AB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  www/static/bootstrap/js/npm.js
- Size 484B
- SHA256 c7aa82a1aa7d45224a38d926d2adaff7fe4aef5bcdafa2a47bdac057f4422c2d
- MD5 ccb7f3909e30b1eb8f65a24393c6e12b
- SHA1 e2b7590d6ec1fdac66b01fdf66ae0879f53b1262
- SHA512 81bc329ad688d411fcf3decb28454238ec478c192b6ac19a3ee07e9939556cf15df91fc7e689802927bdef0362483fbf1659a7c92f877bdc625a56983967cf2c
- TLSH
  T1A4F074E49FF9AC543B5209AB105E1B677326E985A358D875D02E08FB59D89CC0B85CB0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  www/static/datatables/dataTables.bootstrap.min.js
- Size 2KB
- SHA256 ea7406e170bf30e3a603685d639584e87dc9aec40de3306b6769bc894eb6531b
- MD5 eb358384ff6e220c170b71197df49852
- SHA1 bd9605cccc6d77ee26c19e1dc4ab044ef178e731
- SHA512 ae6ef92a39ca9a50c5afb31e505815338734770c8bada19f66ab139edbd449179aa8bf9ff1028994943d9bec809e15e909d4c1f5a81ae2dd88fe8ab6e0bcb87a
- TLSH
  T1F34174013560B1950C67C1DE5147009394A3E4BAF0C968F713E4DBAEADEEE5924A2F7F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  www/static/datatables/extensions/AutoFill/js/dataTables.autoFill.min.js
- Size 8KB
- SHA256 117b9d2108979424d31100beb42ea5874a9356ce3aebdfb68063d0414b86ebc1
- MD5 7bb8463da4969ec3a4c82bb789916ed5
- SHA1 bb8336d5ff1aa74ce8b4b32afb7856ed9d696f9d
- SHA512 b4f9243dea89b110414efff91928d04504547cd8203246a4cd3481f81ceb9f4189e04beda8a9b0c6f26bf15c97dc6f319f8a056596b054c6966dd1ff74fee3ce
- SSDEEP 192:yvd+1rnWlwZ0kRzMB+e8eMnEWFjHW8ev8e1bYjGjQJeHjViyvyMy+yF+buxuxMjW:yvdIylUdz7nEW8biAQdyvyMy+yFRHP4N
- TLSH
  T14C12B6AA36153B75D7C8F954816D5A1F3023B4EE620190BC3D3CE8E72A58C6C35BD9B8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  www/static/datatables/extensions/ColReorder/Readme.md
- Size 1KB
- SHA256 c2b30956f271fa6a15fae5b5f882edeae7be657f4275842b590e9c671e145174
- MD5 f5f418cc6942fdbe0b0832058eaa5124
- SHA1 5928e793afce2bb08318d3b09db05d28baeb6d07
- SHA512 26220028e476ba30e95d9638286457733223c4c6631a2186bfecb69ce0224671a2f979c9b10f66936c30855d7c4d4d1196783e289c41f9cf0b9e3906225d4c03
- TLSH
  T1D221A752B75A73201812F291B05EC8B4EF34B066A6C152253C6ACE5FBE1086973FAE84
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  www/static/datatables/extensions/ColReorder/js/dataTables.colReorder.min.js
- Size 10KB
- SHA256 0efe9778e0df9a471262c126da078646856e05854e84a72f5a538fe74ff904ba
- MD5 42721df869bef756071de3cc373315bd
- SHA1 7c1a9a2cf8d8dc10a37b5db3c19b78a7642eb315
- SHA512 a6f9f5d442086673ea429343d9bbaede915ac5973df2f0910b4d6cfefdc4d7890c965a4fb28432f9adf301dbcac407277ab02b4c6f44953179fa98810a7ac384
- SSDEEP 192:ASSEHO9d77O4FxnLmZH5lZbleKqPIFj+B+r1aPNptoJV8FOFH9+ZQM1tFpKqaQt4:ASSEHc7S4FcLbleKQIFj/PJVxH9+nSqM
- TLSH
  T1D532A30733182B31A6E5F695406A5E1FAC2BA8166D48126C7C9CC8CB5B81C5F32FDD7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  www/static/datatables/extensions/ColVis/Readme.md
- Size 1KB
- SHA256 188e096a5f1021aa28de42a571336a57faadfa57cfed3d085ec9fdfc5b6d7960
- MD5 7f2db09a5d739612bfc6c3d8efccfa44
- SHA1 6dd4bdd6d84b126e11ffb97f9ad1d981391e87a1
- SHA512 4a5e583273639c185834a0550337ef752ed9f1f93fc013d8335a0ecd4029721505833db74f5cc2850c5bbfeb664f777655d7cd439e18df465a21c945cec89c31
- TLSH
  T15C21C966B31533208903B2E2706DD0B8AB35A05175D165B03CAEDB96EF108B972E6A85
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  www/static/datatables/extensions/ColVis/js/dataTables.colVis.min.js
- Size 9KB
- SHA256 2543934004078f3a2cb96d9a3e2d57a55a93d144facc4ef6b5e9d19ec1d9815c
- MD5 5152e016c133876dde1ed60cc7b2d4a7
- SHA1 6f989553bc9b442296b1ac0d67634bd6df2c13f7
- SHA512 ed98eb9cca3a5043beaf9202164da4b5e6ebd0d7ff31c611aa5cced33764b8b16ed51678c6c97560cdea47e191a9fbb2e3b7b2691471050abe94a7500e6d8e17
- SSDEEP 192:w2Cij+y8LPBVExImsz842i4ZLhzIbYzMbR2EVQa4A7cdyLZFX+M:cLExImsz842i49h8bYzMbR2EVQa4A7cQ
- TLSH
  T1962276C733A83734C9927570053F6516B873546AA984358CBCADD6DB5F94C0C22BEA3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  www/static/datatables/extensions/FixedColumns/Readme.md
- Size 1KB
- SHA256 ada89cc60e76e68ad75881dae059202b1472f2a6fc230ed911c5bf15f4ae3435
- MD5 27069b218b89439d9571b55782fc6596
- SHA1 e94b81b56c451cdc5e556fe876ad49aeda94acdb
- SHA512 ce0ac72c1af61444a3f7f3f69d13f6dc434125650a7231e38054a3f16542f6aa353377dfe300cfd4487bd8224682debe38abba62f3307116f33bb9902c56def4
- TLSH
  T1EF31EF1B671633300A93B1E274ECC1A99F359051379170F53CADCA15BF01D7AB2F2A85
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  www/static/datatables/extensions/FixedColumns/js/dataTables.fixedColumns.min.js
- Size 13KB
- SHA256 e8b93a06d1e35c1fdb9d2503a26e2c3991156b50bbcf042706346a3165f94b3c
- MD5 333835b4607aba4adb0706cb54a5c8ee
- SHA1 e8a089df6cb13755b368c07876152dcfdb0c767d
- SHA512 6b05f940ff082dd61d9e4b3797716b60a8d912db658435b0e45a37e6bb178a45900065b215e68b490e2c71c39ea2161f431d8e04617ff7ab9f0eb0bc15748a7b
- SSDEEP 192:ntWFaSMT2EGeDZ5cD2Mw9boErcurWaHKa4AYZ2ySzENWEh9m8FTbAc:7CEGeDZ5cD2Mw9boQRKwYZ2RzM1bAc
- TLSH
  T16F52A85636303372C0D575AAE0FA550EB03390190B0648FC79ED96D64F9DCAD21AEBF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Maps connected drives based on registry

Enumerates connected drives

Enumerates connected drives

Maps connected drives based on registry

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32