dfd9f7b832e7d55ee9d04056a93ff4e24f0db0abe3f96e05db8a250db0302a10

Sharing

Copy URL Twitter E-mail

General

Target
Throne-1.1.6-windows-universal-installer.exe
Size 103.7MB
Sample260626-xgql6sd151
SHA256 dfd9f7b832e7d55ee9d04056a93ff4e24f0db0abe3f96e05db8a250db0302a10
MD5 7796e6c4ffa53cfc61d62974e34388e7
SHA1 1d832d1b330109f09061875afc845d0c65e35eee
SHA512 70b94c26dc42710887c1d1f5dc7b5819e491767b98b3966b75919aa215c768e91cf9d95228f33c66fa98cf89598f4872c4b2d02539210b46ee3273f331cfdc05
SSDEEP 3145728:Y4+OVBK9+n1PY7GUvEgJ0bCS+xCZ8QiF+0vtJZIMG+qew5ZLU:Y4+O27ID+xCZ2A0v1pG5Dk
TLSH
T16A38330D3E171655FEAA68390245F141CE549FF2E3E0ACDA0B78EEE54E706C0A44E97B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Throne-1.1.6-windows-universal-installer.exe
- Size 103.7MB
- SHA256 dfd9f7b832e7d55ee9d04056a93ff4e24f0db0abe3f96e05db8a250db0302a10
- MD5 7796e6c4ffa53cfc61d62974e34388e7
- SHA1 1d832d1b330109f09061875afc845d0c65e35eee
- SHA512 70b94c26dc42710887c1d1f5dc7b5819e491767b98b3966b75919aa215c768e91cf9d95228f33c66fa98cf89598f4872c4b2d02539210b46ee3273f331cfdc05
- SSDEEP 3145728:Y4+OVBK9+n1PY7GUvEgJ0bCS+xCZ8QiF+0vtJZIMG+qew5ZLU:Y4+O27ID+xCZ2A0v1pG5Dk
- TLSH
  T16A38330D3E171655FEAA68390245F141CE549FF2E3E0ACDA0B78EEE54E706C0A44E97B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/FindProcDLL.dll
- Size 7KB
- SHA256 cffec7f0bbcfca2873c510d93666e0ebe95e236433c3c415358dffc50a70e44e
- MD5 81a424cbfa89976b1c40da870d8ad4bb
- SHA1 a43f1b04eb8726552eb8934b0db2e76c46535e35
- SHA512 555d28e23fe7dc97400356ae6c1e13b1e1e18633a153fc7ddafe76a11ccae8d166a550dc0c61c03a9041f691ea74b2501c0f5ad20bb8390375ceb63128e1af5e
- SSDEEP 96:PNrt9XBrYR9YVi4fl+l0tMh6VLuiXX8VASx3aPmh7z7GOVINv3vTx3mtJsBKz:Pv9XBrYR+jtyuLucgs+INv3vN34JGs
- TLSH
  T105F1B7435B011472C1F8943CB8DB45375BEDB23062B36787E92BA9263E991D07C7D7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 28KB
- SHA256 b89448b9fd7be5ef215cac6d973a57c0e75e1fffa25552afe174855c9b71fdf9
- MD5 81e34f1c4b04a15dbce200c52f598f67
- SHA1 f40a922ad7a5494e2aeeaa2b961d96738e888af7
- SHA512 577f52a292075269f0e8ec4c6d243b2ed411872e009839553020929a8263174ad97943f150543e4ea6cb327d95e227f4065441a9d2106b7cabf1cb872dbcc181
- SSDEEP 384:xmEs6sVqQq0DwRiGUaLYuAXLaMoy4m973uwYkvZ6YfkzB8yy1Eiu8ILvFd/9:xmEwqZ2wRiGUcY8TBsdvEbB8yyvIJ
- TLSH
  T1DFD20A2AFF06C8F2D1B1D570889EE677C526782957220E7BFF1B9E4CFC236825A19105
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 7KB
- SHA256 5f55afe7117a72467fe8d51b38b2891ea3c0bf60f4bb95bc8e238e5e9aac3a0c
- MD5 06d43685a8c862d4e0f836f3aaf2bb66
- SHA1 4e3b686fe03b188d84e8547843d43f8453534967
- SHA512 9d189bda2538b52c96e8a11833344ae2f14148be5e8dad0ece42bcb3b93ae7be9352b9504a03f4d8f0ca69d317ea11248d619c27432a5e4f1340305e9ebf3b83
- SSDEEP 96:krAEHQ+FgZHgpVGuRkNB/R37RO7nsyK3gGam:GF+H/Ykv/RLROzaQm
- TLSH
  T111E1B849F73845F2D463E53080DBE22F7E5A744C5A2B1B0DFE5B2D2AB8266701C5E30A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH
  T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 14KB
- SHA256 778b2bfbf3f4e641161f40c8174442a4d3865f097e3a2a383356dbfcac8005ab
- MD5 2726673c720a296442c8ed134b41d169
- SHA1 b8050c85017fcda78f6b82cc86ad277bb0dbd539
- SHA512 95fd8cd96a4c627dfc1a89a98630ead3fe431360ab15f2324a52fdd03b2b493bdc44a4d6d0189276826725ea4e48aeb4711459a459b92a80be51e9431b70bb0b
- SSDEEP 192:clWWck581HwPRLG/CocFR1w5nEYkv/RGl5BoiS+6SZSM3CU:Hdk5SoRLG/CocFR62Ykv8l5BoiFXyU
- TLSH
  T16252E50EFB0A44F6C572D834548BE72F869DA415C66F4E0AEF170B0CBDA32B5280E346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  Throne.exe
- Size 51.9MB
- SHA256 e4b5ce022fb78d4a10283837d940c663a3250ba990f269f88e194cf29ddec53e
- MD5 0d1d45d5f80f0dc289b9805e5bb02d5c
- SHA1 d9a3b26c49a8fd1fa89ffdc1782b1659a75d6456
- SHA512 274fa8d1124af73c9a8fffa807bf830339e4a162e7318133600767d9f0a5b559cb2a326f06ceda9e0ff5daf13cf0688c4b270515809ac8cf0ee41ce03a03f0fd
- SSDEEP 393216:yZvQUc+mSjM9162+N3s5yHJpBmiFDSY4AmKCuKFdu9CwJsv6ttDEwafNA:Ivut9k5TPmKCSDE
- TLSH
  T14FC78C0772F50185E5BBC1788BA78627EBB27C4553309BDF0590A2A91E33EF45E3A325
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

persistence
behavioral13 behavioral14
- Target
  ThroneCore.exe
- Size 61.7MB
- SHA256 39796600c64c07103b64430b8b880da36bf373d5aac567d14a9c49cfdc92f6e1
- MD5 904c972a0805309d7213433135ccc674
- SHA1 e0bce744623bddbcbc8bfa97df544c1e8ddfa254
- SHA512 abfad44e5cd00e48e7c79cfd684549a7cfcf2f10d4dff04a24bd171d6f12b9093e542fcf4087d6e375330b67c7fa3616ca4da3f6f225fb1af782ff832c34ef5f
- SSDEEP 393216:I4EiIY3OtgXi9x9JF4LAPQEAS0lK/o/GQWa:I/T0OiXi9iGQNlP/BW
- TLSH
  T14DE74997F8291CE5D5ADC430C9A695233B307C55872063DB1B60B618AF7ABD0ABFE350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  libcronet.dll
- Size 9.0MB
- SHA256 c7434cfa93c3041321dd19111c4de6c52b8a9531a65661ba45425d3c51ec69e2
- MD5 72ae38a69dc9ced1a13f1ed58d943585
- SHA1 e977eb3d0b79992c27fbee9151da7407b38e978a
- SHA512 f87d6335035d1452c9bd5ab1a07cdfa7380623b1451084358a923602eeb4315249d8588442115a4877c8754c1fb8e4709e19fc148e6f3676796b75abc9a9dbe3
- SSDEEP 98304:hlOTNPRHJWVfW2m3tdB+JblCblDwybHULDWayIto1YyeLuNZShGp1b9:eThAfWPB+JblCblDwybHmoFeqLb
- TLSH
  T19D965B43F29651EDC019D079971B9232BA71BC494B3579EF0B90BB612E72BE0A73DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  updater.exe
- Size 616KB
- SHA256 416933f908df2ce8638f7122754c6c744403fb9189f2640cdeb13f89072ea010
- MD5 44d81168d1b4da3c0950e42a28f8e2d2
- SHA1 6da43feba67ceb9931b640dab6fb82301cfdb329
- SHA512 68d73d495f09a4720a7286cea8ced1e42367e73fb620cfdfd8dbb8267ba872a909591c564a9b57ae855340ec45606e842a65507912419451a748139c17b2863c
- SSDEEP 6144:IDTSLcANjYlVpX9q71hwjOAvaduNTbun//MkC89CtAHFhbGwDFXbX0B8dpII5scQ:IPSLfNwXMhwjEKTSn//MHkGEFXDvh
- TLSH
  T12FD47BC6F69325FCC86AC23581671122F976B4494320EA6B439CC6313F667A36E3DF91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral18 behavioral19

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19