f4f3f560e8712de604144bc9a28a2987ce309ea70c4a5781bafb58c68830fd59

Sharing

Copy URL Twitter E-mail

General

Target
CommonAzureTools.VwdExpress.ita.cab
Size 129KB
Sample260625-w1mtyset9w
SHA256 f4f3f560e8712de604144bc9a28a2987ce309ea70c4a5781bafb58c68830fd59
MD5 f8216f9d8d3cea08927ddc704da51cdb
SHA1 c22a22287ca4f8bed356549b59519f8cff5a05b0
SHA512 67a79002661c594091738e5ef447aa372ae6bbc02af8de33d59530283bdb30fb343ac1644ff4ae2f09902d3a401cd82b1453d5435f88ab46af2d3b70607f7e32
SSDEEP 3072:yB6Rv+Nbg95uCwsPH4toXeH/Z401SpuXO+hIE:yBxbg3IsP0Ya/Z4sXO+
TLSH
T120D312CD0DB88046DE9BCD486F765C56AD7C9382AA10EB304500F17EDD9A69BDF380E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  CommonAzureTools.Contracts.Internal_LP
- Size 19KB
- SHA256 23c2942ef1802b3ddad92e6b21355f3fc4a064c153b3e5607a7be5d69e4334fd
- MD5 32df89f1f18aefa01ab8ef0217760f3e
- SHA1 c8363fa0af51f51a9365393b8f305c4a8a72203b
- SHA512 8020908a14da49eccc8deb4f0f6b681eb5e3760af34d018bf97215ebe1ff628b7b9130516544c32d7f1006e85e29299eb2becdba1ef0069df05a6068307ff0c0
- SSDEEP 192:XQKxAWLI9UzvXS9YOCAs/nGfe4pBjSPhQOEdXWm78RFAII1RHnhWgN7aQW+qnajp:tAWLPzv9A0GftpBjwgWERHRN75lurd05
- TLSH
  T1049208C2CBBC8143E9935DB063A8DA477D3DA7DB5D2092550059F1D928E37C1DB24A3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  CommonAzureTools.Contracts_LP
- Size 22KB
- SHA256 f3a7b67366e370f72e6117ad42a01cdc1d704c18e820d8ad89977cab7ec6f19f
- MD5 15456180a22b170d12b145991bac5be3
- SHA1 2af675c98a51e3ef36cc09c16c27761c371510b1
- SHA512 f912ed8590fc39db8f9f8a5af162aa4659dc5e35017a9ad21a1aff7abf3078a5ccec60de978645dabcbe422319ca88eabf2b9300d61ae4eb7b05fcdba0355431
- SSDEEP 384:AEWlh2+vbMuT+quY0GftpBjn+ILKHRN7oSklv2728Nw0S46ws:Ax2AITiZmoSuBR3
- TLSH
  T1CCA23A918BBC8183EE936D7052A8D9837D3CA7C35C20951615AAF4D91CD37D1DF24A2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  CommonAzureTools.Contracts_LP_1_1
- Size 19KB
- SHA256 e6127dcd021e0f1d1021caee9dfba24eba3615feda1f66ec3deaf09c3bf4fafc
- MD5 488b79987b0ca29da27a6458363ab8f2
- SHA1 ecac53d14ebf05439f53d8a2709aed0a3aa7e583
- SHA512 2391a227a8baeaa480bc2fe01c6248be7fb9daca3dcde6c5963e612d4564155ddfdc6429042b307603f2552c331495f5240f803e72bec467de55ba39a1480e32
- SSDEEP 192:PGxwWpuMg7Y31QnMTI/s/nGfe4pBjSLhW6WF8ilAwoHnhWgN7aUWHYqnajc6h8OB:EwWpuMh1q//0GftpBjQH3HRN7nlY28zI
- TLSH
  T11F922A858BBC8143E9D35D7062A8E9477C3EEBD34D20921A0459F1D92DA37D1DF34A2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  CommonAzureTools.Contracts_LP_1_2
- Size 19KB
- SHA256 f89abc3327f9906b2ef4070b12f45fe6ba6976700c3605bb1a1756a7d9f5dd04
- MD5 3d732b7a5c46fa73e037d05a428e8c71
- SHA1 4d7d5356295790e278f9b0af90b9904e7db72c49
- SHA512 6f7b72bbf55e1b048053158c9dae37497afc0d73e16f64ed5b9727b8bba980bacd4d5b0d1e18f73a6e09a98f78b13e8e49d46286ec3dfd05d977ea20d765a594
- SSDEEP 384:nWWpWCqdoA0GftpBj4mERHRN7IlcE/hAe:nsHKiTEBE6e
- TLSH
  T12C921995CBBC8143E9A35D7063A8DA477D3DE7D74D209219006AF1E91CA37D1EB30A2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  CommonAzureTools.Package_LP
- Size 251KB
- SHA256 43b9e9f3facc9ea60c7251d1c75491da985b401cd0d49bfa8756d38ce80081cc
- MD5 183d747dad88dae4e1ed1d89d5234191
- SHA1 1e660f508068ca81bc4954cfcf8351677c499bb0
- SHA512 f421350d7da0f2274eaf690a583d58382b54aeca3a00ee4a7289eb495b1860cdf0fd0c19c087ecbad2f9c1df8cf927e21e186e9a010a2d0f62470705304300a3
- SSDEEP 6144:2VQaHBGqiVDW24Sz6k85EGUY56bSfhF6HMcb01td:2q4Sz6k85dfaMcby
- TLSH
  T1C3444C59A7F80001E07307362969E184FF3AFF8A2952F17D00DD250E6596785EF2ABB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  PowerShellTools.Package_LP
- Size 27KB
- SHA256 63b198bdca2a82bcdc7bdd3cb30f21146cdc1408822db6310556a76e33ea6798
- MD5 994c3c303f2663f0faf0891c5813e9f7
- SHA1 f047a45bfade012fbc0eecc31499b5a11b0ff03c
- SHA512 11a8e122dbe9fac775f40a8fc1f24fddd9c091255bc297ed92d92581ed6d937a52d5f65f79adecb4914b19269571c8c91d8d46a94084649492b7110ac2665fb5
- SSDEEP 384:RWsA7yzTKhwaHus/K3bP6DZW9GBzv9A0GftpBj8ERHRN7YYJ8lVPb:Qp7EWhweK3DcVlJi+EBgj
- TLSH
  T13FC26C9147BC4153E8A35C3025B8D9477C3DF7C74934C26E11AAE9A92CD27D1DA28B2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Utilities_LP
- Size 46KB
- SHA256 57cd66277be2911e60677d23d6aba251f8a03a56b86e968e197025632a5c2804
- MD5 4c2bdf648b87d9d5dc6e8f79d243e5ea
- SHA1 f4ef00113ea8a8868129db7677bc0164eff0d02b
- SHA512 4c9adc21cbaf36fb25c3b7cde073da4625d74cb18e4e27107375af61241b107a69fa98b9536fe90b0f71f7853075dbe56c4aae2ac7ca9de5b5a97a1d22ec959d
- SSDEEP 768:QUMCY0/AHXaefIB58JbSOEW1FsG3Qx6c16r4wPXLWKii0EBMY+0c:7/qm58JbSOEW1FsG3Qx6c16r4wfLf4E6
- TLSH
  T1F923F78197FC0115F6B30E312979D9446E3AFB9B1920D26E009D650DA8B27D2CE36B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14