7655e6c92566ff3050b46d797f32d09cc1f4665ea3ab64cf8ffb6d1cb0e43aaf

Sharing

Copy URL Twitter E-mail

General

Target
Winslopr.zip
Size 47.8MB
Sample260628-wtbhcaa13s
SHA256 7655e6c92566ff3050b46d797f32d09cc1f4665ea3ab64cf8ffb6d1cb0e43aaf
MD5 4e5eeda4c06eda0f352921013903d452
SHA1 ba80ac41c9f6572f0f09c8dc442889595ac02b81
SHA512 4b62da74bcd24f7651d2543bed883ee937ef49dc3a80c5ef463cca53fcb695c51630cfb02891ad87edcf9d7b9ef419b74680699d96001157fea839de6fbcb58b
SSDEEP 786432:VTWWJtomc6M8uIqvGPIofzfTwaSAKeXT13GEBO9KAgnJ7yOwsXzgZlh33wthF0nX:VPJtoz6MYRPRzLwaSM1RJ7yj+gnJ0eXH
TLSH
T13CB73378DFF0D0699834413BADD53EE273FF8F2949F994020EA447A955836C2BA3B548
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://raw.githubusercontent.com/zoicware/RemoveWindowsAI/main/RemoveWindowsAi.ps1

Extracted

Language

Source

URLs

exe.dropper
https://www.microsoft.com/software-download/windows11
exe.dropper
https://go.microsoft.com/fwlink/?linkid=2156295
exe.dropper
https://github.com/pbatard/rufus/releases/download/v4.12/rufus-4.12p.exe
exe.dropper
https://github.com/pbatard/rufus/releases/download/v4.12/rufus-4.12.exe
exe.dropper
https://github.com/pbatard/rufus/releases

Targets

- Target
  Winslop 1.04/Microsoft.CSharp.dll
- Size 958KB
- SHA256 c56d26a7cf3a5d117c4ec523d76df56774b2001a3e1e9c6c42312d252a34205c
- MD5 afa73fe7601c3a38ac6c035d271f9338
- SHA1 32ec373f7b3d8a105aa984debafd316b648f2359
- SHA512 76290bbd4936b4c6bf666ffb29e8236b5ddd143559409dd31fb3b9c13a76a08cb262b87ff72bdf6be4b324743708e33658fe9aa6363861769ade65481cc5d1a6
- SSDEEP 12288:I0d1linUIUQzr7fYhRzRvhDkVv4+X6MR7Ea3Vu9yHxQVWz9NEF7tuB62:jd1lOzrchRHkVr6Wl3Vu9yHiVWzTKpu5
- TLSH
  T17F257E1493D80E16C26E837CC1538A12D5F6A443336796CB48ACED742FC77CA9A77A63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Winslop 1.04/Microsoft.DiaSymReader.Native.amd64.dll
- Size 2.2MB
- SHA256 7f8dcf37d9d66eae14c48a79fa2fcd447bd0f38a21be0203a9c4a89398aacf28
- MD5 a71cd05c01f0fc603c0bd782516f806d
- SHA1 c15e261d5e7318875d324d28ab70a883cd434c81
- SHA512 ce53f6dc1f02889ed6fb1f8df226f9badbb039f79505cdbd599a00a32b6617da5e19f2ad7f76bb8134b3ccad39fab2209ed8ec6ae42cd30402c4e450fc19fa88
- SSDEEP 49152:jH+fGgFyzuNiG6H0n8D1gkrz/OAyFAopdrq/c/:+GgFQq8DT/ZyFDN0c
- TLSH
  T1A4B58E87A6E841E8D57AD178D667520BE7B238010320A7DF42A4876A7F37FE50B3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Winslop 1.04/Microsoft.Graphics.Imaging.Projection.dll
- Size 26KB
- SHA256 a2c317478c5d20a180296b7c205e93b0436470cb105e641fd6cdbf1a2dfea21b
- MD5 2d909408da8402eda45253917c8b52d6
- SHA1 3dbbec22c5a1961512f15d8695779899842ab53b
- SHA512 17e9e9df0da4ed5761a36c0967b38f937ea2b3524b581aefd86670e9e84019fe8b6086031dcb7186155ac6d0c4a7e513b8a6557145d4f71f5399abec08568bd4
- SSDEEP 384:+4efaxBWmmIaWGUH3QVXcK2O70fdlxW4NMWrHRN74PPTR9zhbya:xeymItGIQt6RiV9zdya
- TLSH
  T152C27D01C7788313EEEF4A719EB5DA9ABD38D3932902DB2D1508F4550C637D85B227BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Winslop 1.04/Microsoft.InteractiveExperiences.Projection.dll
- Size 1.5MB
- SHA256 7ba5742467fcc95886a91353fb91e1f80edf1a5a535cdd5fdafef04017342bfa
- MD5 d2e6cc8922f6da99bcd7c89bf413eb75
- SHA1 1f3e9cb54e232d053342d5a6aa6d4a92a7c091ef
- SHA512 98baeebc773d52ccadb02d8b4d289cdde626025e1676994d170c752c4209f492fb09adf313fb9c7cdfba614e33beabc5de14eb57108733d1fa56b4f37d2293e3
- SSDEEP 12288:nCIq1Cl7e4GjTq1OMtNa9tLcS06MhjbAluVft2hW23C4onWtBOHfQpG:C7q1OSNa99UTbAluVZYp
- TLSH
  T184753A50332A623BCD1F36B5E242862871BBD24F635EE30525697AB41FA73890F456F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Winslop 1.04/Microsoft.ML.OnnxRuntime.dll
- Size 238KB
- SHA256 19f0cde6cc8bd8ebe3d1b916b0ad7cb7ab85481ed09865854102eab41269ae6d
- MD5 5ba92d537a1b48243d65945e7be63a9d
- SHA1 39d7e84b8a8f42088f1523d1580d15da53ab4bbc
- SHA512 a3679ca78cac0f94f05904386a038e744ade61fbe7fbce0510de1552e48a82e25312dfad6d9d8475dc7c8f6195e14222818602fc6eb97f32e5db87e71d27ec80
- SSDEEP 3072:+4icWFZSI5gdncSO1d4ZCelG0c6OhOpcHVAQT6pyjHzBCFRz8VjREgiz3hU2jnNs:0cAZrW90dLeLcHN6uREgAF7+r
- TLSH
  T16A344C0177D48E71C2AE8734A4B180445774FA0772B3D77F288CA8FA5732BD18A967E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Winslop 1.04/Microsoft.Security.Authentication.OAuth.Projection.dll
- Size 79KB
- SHA256 38d0d9580949f485207a4108383e66423f705ab437b3849f8835f59d49801718
- MD5 4d5dbca8720ace749652a920bed0f094
- SHA1 7edc893d215121186b7553b1827cad9302d1d5ff
- SHA512 a986565bcc7267f7f76a786ae04d981665607ae286eb8ac7b8242fe79e93fcc3f27b5b28437b2c96c040dca776c4a56480f373380ab021757d2a3b00a1d99fe1
- SSDEEP 768:nvMdsqmsEQe7d5CDJ+ID4fuQZ3Gr4Znm5MBKxtgFdnmWOlt6u5iGbkVNV7wl+2lc:0sqmsEJ7rW+IE25MgKdmGu5iG42M2rzy
- TLSH
  T189832A0157948B2BE68F97B9F6A0571ED339C2076263BB171A04BDA44EB37C493071E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Winslop 1.04/Microsoft.VisualBasic.Core.dll
- Size 1.1MB
- SHA256 331ac20fe9a41ebae155a955f2dea34bc247128a5bd8d299d7a6cd0da01acd87
- MD5 a250070e475c67a07fd1555303277d77
- SHA1 9ed13e565eed6af450f225898d2c928b0f7cc631
- SHA512 ac93d963f17ea3d416e32c74bf5a7e2a41cec2dfa9d808e4fa0c0a2b6528a7d1819920982a837fbb420ef7807541aadd7d2d5d745c034134bca168372e41c5f7
- SSDEEP 24576:wyZKmvH5MjbvtN5cao3Qj8q15vV2Xgulf6qd97x5Omm+:dYmvZMjbvtN5cao3I8q15+d9l5Omj
- TLSH
  T1B1458C09B7C4CF1BC33BA6B9C7568762D274E5625751A2CB1440CC362B4BBD3B3B12A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Winslop 1.04/Microsoft.VisualBasic.dll
- Size 17KB
- SHA256 ee87b36e158bce45e4a892fbd13051daa7e997e4548d25b3dbc795aff3fb0477
- MD5 a2c589e142adaa7126a238541100a4ea
- SHA1 216c98cfb1d47082fbc9831dcb143895dd41c844
- SHA512 f9309c9cecb80d22a83524fe641a6812578bfc6ddd7e6209095355f5d277e24ed435225afde19cc62e50919483d16fffd2a99abf8387ae8627019ca1b62af063
- SSDEEP 384:P7Mu3c0m0xWmH6l9QdWNzPDHRN7/jHGTYAsR9zq7TD0w:P4uM0mJ17mMj9zmT4w
- TLSH
  T1DE822AA5D7388903EDA76F704EA2D5437EB833C74A319A2B1559E5051C53381FB3932E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Winslop 1.04/Microsoft.Web.WebView2.Core.Projection.dll
- Size 650KB
- SHA256 90610ed89f0c14937a863d928aea7fa6aea952fb208f3950bc6976d07b42da89
- MD5 87ac697d5ab15d5e54f26239282f2202
- SHA1 232bae9c639db98534260b190620842130d42e80
- SHA512 e9e685e588312ae882d6cfb1ebd8441c009a36598995e0d90f5c24ddb7a6335e5f679af827cb025126cf119b692b42baa03ec07ddc237930e8b87ccc90f24c55
- SSDEEP 12288:UKq0SMkz5x4uJ4sGEvQLsnbgTM/tYUWdCZJLzoTMr99/DF2cbxSpWDSplq+1lqVP:uVxtSsqF4AGXL
- TLSH
  T186E40750676C853BC9CE6FF9F9E0867CA339C24B769B635B1C09A1E40E533A16F144E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Winslop 1.04/Microsoft.Web.WebView2.Core.dll
- Size 767KB
- SHA256 41944932171fc8269bb1c0afdfe1456793a9f6f0caea9f149e88b16bfc25b031
- MD5 d1848912fa7f8c6ab6f07d5624e649af
- SHA1 574c72f2e2d1de193db60d6c9e12f0110c4bbef2
- SHA512 b8742d36a335cce56aa6b8bd62578aacaaeaa666c126249e7183b698c8cac1ea867521d711fa782b3782771ba2c273663308839d72fd0dd4337cc62498110d31
- SSDEEP 12288:i3rDJdx8QNKz5Bv6HeX/i9/ZX9/idrDkiZotkqUX03Ech8ue8ig5jw+N3ZDqI9Xr:i3/px+5Bv6HeXK1Zt/yk+otkqUX03E+
- TLSH
  T13BF4294AD2A85149E579D438CA37450AF672B80A176093CF15B0C72F6F37FF49A3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Winslop 1.04/Microsoft.Win32.Primitives.dll
- Size 15KB
- SHA256 2ac29370b9734bfd2fac7ea4037d759e81b61b5863dfd416baffc2d60a8079a7
- MD5 f0d06ce755b0e9bae40ee371bfb8ff32
- SHA1 fc0941ee7899bef6e9480165a44ff27be4982347
- SHA512 135dc668481722714ed44b307eb3a011b663b21daa0b13582419b28e65a27dec6cb2061fc52f1e7ecf2341e881ac10e4abbcdb50bd4966c6b84ec4c9c796460b
- SSDEEP 384:6jX23MOfHTY1WhPSpWU/hljHRN7nR9zQfOAD:CXUfHTYdDjR9zC
- TLSH
  T1AC725BD1D77C4243ECA75EB096B8D9833D3D27C74A009A2B0595FA481CA3781DF35A2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Winslop 1.04/Microsoft.Win32.Registry.dll
- Size 114KB
- SHA256 3a05fac1f2d66cda1b102b6989c38d397ec81ee0f77e67a1ba4be8d2c842812a
- MD5 302f32dae1288f44132cf370c35e1ab1
- SHA1 fa2430132091b04e07132258f67a2a212acb9a83
- SHA512 03970b72a8e28542c6240e46b261b6308208a7d552cd90f7d07c24064586458de1f0a7f80a3ffb4ce87f74dd1f5e5bdff3987e6fce8fbfa5e3a6e80d447ea95c
- SSDEEP 3072:SiuwrQx6bAYMteaJSvEdy7IVicYv5ZatHi+1L:JMVteaJSvEdEnRj+d
- TLSH
  T1BBB36B20BBC4410FEA7E45B89C734846E232F5965742ABDF0695C0DD2FA3BC6F632562
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Winslop 1.04/Microsoft.WinUI.dll
- Size 7.0MB
- SHA256 b745cc38595f48f6b33c02eefc5d5df15a7759ea9e918ce1c18ddf3eb050ce38
- MD5 4164bc68e966f977f88db012d6884f50
- SHA1 13ad9a5fed40fd39ac2da72e4726137d3ed19f5b
- SHA512 5597ba4c3a6ec4e47716d53b0821ff558ffcacb2fa847849e63ff7cf5004241831603734ce5865070b693664bdf4f8680eeb74582de5b6936f10f7d3cbabdf82
- SSDEEP 98304:05dV+s3qrEGXXxqgpP9ZfnNstNW0C/DjZbnwwD4byStxM6e/gRUjln8jqR9l9zJu:05dV+s3qrEGXXxqgpP9ZfnNstNWxZbwT
- TLSH
  T130760900EB6DDF2FC40E12B9A0B25E38C664E58FD78AD756341DA4770A9738827076E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  Winslop 1.04/Microsoft.Windows.AI.ContentSafety.Projection.dll
- Size 36KB
- SHA256 e9ba1e2a70f560e4a8ed2f6178f0894701cd086ceb9b590fd3333e9805f5d36e
- MD5 82a78d7af116fb29f8d71432b7c4ee66
- SHA1 4398b40bd943c7ed8a1bd40205596204d8e864eb
- SHA512 0861d1a55604e0ae1ec0945ef7af8a4a25158d0367d68ae5cf0ca5ec611e052187491e813deb9ac256841de0a93714228e34e00d775812aedb658b3726cedc3d
- SSDEEP 768:3f5XO2Qxqw7oooXl3A9gwUjPIoy0+2i9z/:zBKgwUjPhyF2+z
- TLSH
  T138F24B518768C312CF9F8BB5F469EF46AA38D3572542E7061984F0B80D937D88B247EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Winslop 1.04/Microsoft.Windows.AI.Foundation.Projection.dll
- Size 25KB
- SHA256 f2c73de8af7df6fd09c6b98510323ae78c20afa5d7df1a5e10d0a5a48f87d96a
- MD5 8effb31f770a65b88e4d927b7bd0e6bc
- SHA1 661f7813bd20664b5c8c611bc186ca956bb81b5f
- SHA512 97b21f69e2b1015ece16a420a0d797b870a166ce09274697a089bce84b5460726e0ff899d84819d1c9f781fac3388bb383e626083ac0517c8e7aa12907d2b528
- SSDEEP 384:Lyqt1CU9VtYPBaKpn8AHK7eNQJmjOY0WfdGW11+aHRN7qv3tGkeR9zS5:5t4QMBjp8AyeOYn3+2qgkC9zS
- TLSH
  T1DAB28E86977C832BECAA1D324AA7DE527DB8D7872502AB360048F0542C533D47B1177F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Winslop 1.04/Microsoft.Windows.AI.Imaging.Projection.dll
- Size 82KB
- SHA256 bb1638fb968ed118192a5f07ed1b4bd9a8062a154cf357c7fae9ef50a3727503
- MD5 124d6084b88ca1538741207dc2b0e18c
- SHA1 cf2e81aa5cf3d7c657c816e15482f11f5932f016
- SHA512 0d2321af2906d0d83c14e68da2310403089568af5270b636991ac4a23ee697d37928ae749ddbe85b68f7a468098982a5eda945d6de7abbc1290b6979a631d747
- SSDEEP 1536:KYQBSj+2PPzYn1skw2G97rm913ynSz9W2chzG:7tPEnvw2G9nYW7q
- TLSH
  T1A28329464BA58B39DBAF8B32E52E4919D738C3136447D35B3A48A4F06C233E51B056F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32