94b71f109191df154a3e124f0cf5aed3e48f6d9f5b6e04d587903f3a43ae4bff

Sharing

Copy URL Twitter E-mail

General

Target
94b71f109191df154a3e124f0cf5aed3e48f6d9f5b6e04d587903f3a43ae4bff
Size 4.5MB
Sample260701-2ax5wsft7q
SHA256 94b71f109191df154a3e124f0cf5aed3e48f6d9f5b6e04d587903f3a43ae4bff
MD5 346a0eaecfbd9c23684c22d475b7055f
SHA1 65e8d86f71f03dc17dc0a2e2f869539cb99a2673
SHA512 da4ea98e74af5ed67d4fc2e3a7010120545d07c4f9add7f6e77028b81a62f7233b56ac8099b29ede9bbf9f99f3069be6e9485295adefc9151b99b4eb1e2cb4a8
SSDEEP 98304:fvxQoSQ7mgjOv/JMfSZFKx9mWtMthbIPOHnsHz4FP6go+y+ykUQLg/:fvxSQjY//Kx9XYhbIPMacig1ByqLg/
TLSH
T163263357B311A976C9260931D695C732BF726D164FF0A3233B183B1E7BB359163A3A02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  94b71f109191df154a3e124f0cf5aed3e48f6d9f5b6e04d587903f3a43ae4bff
- Size 4.5MB
- SHA256 94b71f109191df154a3e124f0cf5aed3e48f6d9f5b6e04d587903f3a43ae4bff
- MD5 346a0eaecfbd9c23684c22d475b7055f
- SHA1 65e8d86f71f03dc17dc0a2e2f869539cb99a2673
- SHA512 da4ea98e74af5ed67d4fc2e3a7010120545d07c4f9add7f6e77028b81a62f7233b56ac8099b29ede9bbf9f99f3069be6e9485295adefc9151b99b4eb1e2cb4a8
- SSDEEP 98304:fvxQoSQ7mgjOv/JMfSZFKx9mWtMthbIPOHnsHz4FP6go+y+ykUQLg/:fvxSQjY//Kx9XYhbIPMacig1ByqLg/
- TLSH
  T163263357B311A976C9260931D695C732BF726D164FF0A3233B183B1E7BB359163A3A02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/AccessControl.dll
- Size 24KB
- SHA256 89ae5e9ed94c71972ddb25aeb508ee6fb8c7a39e39e775182bcdba02762e6dce
- MD5 03cc5115234c4868cc8e2116ed949ca1
- SHA1 9cb86d1d2c41da77fd486a128ac43afcd6b8c129
- SHA512 57b1a63316192bd76f65168f07d1797f4d04b98b4a99d0e543ebee3ab4b65b8562ac3f83100c25a207c385956025c10c298ff68a17770bbf0e8b82c7b89d0c58
- SSDEEP 384:udGZ2ESnTqkddTm43saIvybNyb8E9VF6IYiTPxIZHMMZknCC:uMANdTHpIvy3EpYiTPxIKMC
- TLSH
  T145B22C624FB80BFEF9B21A303AF8547747B6B50125A0C18F5316C95A6D217876EB8337
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  $PLUGINSDIR/FindProcDLL.dll
- Size 292KB
- SHA256 acabf187f608858363ce88fcf64e78c09738860ce4a84952c114cf53fa81ade5
- MD5 5a177de1f2e0a85e3fe15e9821747a79
- SHA1 e339619f777fc21ecb731559799b7189c2a324c1
- SHA512 0e8456b5b480c18300515af33a1ca665c20da4c07fa66baa7ccde9dc83dfc9fdde7e4d0ea05a3fd030e67dc96e0619c236410ed59985de9bc95654eac2b36103
- SSDEEP 6144:A+WFR2dU22mRXAtS40ZxdjYHXQohL7cRJ5:Av2dmmRXAIDzxzotQRJ5
- TLSH
  T107548D117DC18432C2BB38346678E2B64DBCA8311D749A8F539C0A795F74582FB36A6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  $PLUGINSDIR/JxNsis.dll
- Size 2.6MB
- SHA256 5163c903fca3c005f740edb9b512a42288522c368a241d4dd9511715abc5c18f
- MD5 a97329864cca00ec55e65846932b17fd
- SHA1 b3082c38daa3ed30252ae042745ab8ce72b240db
- SHA512 5409a54064d52d26de02eccc381ead35e9bb913d6bcc62aa084bea078093ed2b47b13805b775dc7068d3cf600b0bbd06c7cd4c543ad8898fcf4019c8a1afed30
- SSDEEP 49152:fat9QdYYMl6vOgbFih7lz+Ab/M38rzm+vaTA+dPYXcWHEHm8/F4mdS:fW9QdYT0vOSFGlz+Ab/M3yy+QOXcE
- TLSH
  T1F4C5BF02FF8280B2E5AF013491BA577F4D3EAA244738C9D397E119B99D301D1663E79E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/System.dll
- Size 21KB
- SHA256 d4c3a23eff386c311129d582650abce1ca1e15adcef9482a303306fd3a958058
- MD5 5b11192faeb214d966ae26b4bd47cc9d
- SHA1 be5ef8b780d51b85aaac5932f1587e74ca05c705
- SHA512 714eb5c2352637bd218b889c3ed2c564227568e9c01f0046fd096b500923f5d805e372a2a7633d5662e584b5860aad3b546fddb967fb77057d3539b6d80d1d8a
- SSDEEP 384:I8PJlt70esj0Mt9vn6ay6mNyb8E9VF6IYiTPxIZHiW39bU:I+qesjRL6HEpYiTPxIL39bU
- TLSH
  T119A29E6386604CF2F9524D3430D4AA36AF79B6851FE081D3A39BC1416F943C77BF92A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsExec.dll
- Size 16KB
- SHA256 da808e1a14d72f1e38fd846f5c166647202cf2683da618aa7ebc8ce7d2505105
- MD5 b3ca8e6e1a086f41ad2d5fac8ad720c1
- SHA1 e6096a0be2d8ee23bf676e7953ee04ed27d1f217
- SHA512 bb3144b0c3ed9b1ef8edd895a06e0d289f827ad7623c3e46b9e4359c92f41d61f7c914320707658a1f216ebbfcc81586554b127f7b99f05ec759629acf42685f
- SSDEEP 384:FbogBz5N66IuGgmkNGNyb8E9VF6IYiTPxIZHYO:x9cuGLksEpYiTPxI7
- TLSH
  T12B725CB648D01C63DD4F4A7039D468375BB8F1911FA082E2531BC6954BC57C2FFA93A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  $PLUGINSDIR/setupdll.dll
- Size 2.3MB
- SHA256 e30f2d1583462e6556fcb71112adc533f7c004262e2cecf48a6921625a6f4c10
- MD5 7e469cadf8f403fd07c0a29ec0b2a2da
- SHA1 f95ae76a7fb8cc55540be7193e5bca2f9b17ae49
- SHA512 d7ff11594a633171afe44758abe2dae229a8d88f72b1a086f28c3deb3871acf9c49bad44147ed923af00dc74c6a2595e47d1ed48bda0597666649d54201c4b6e
- SSDEEP 49152:AiY1Wf/vu0J9E7od0yMHacx967Tgp9XJ23:w1au0J9UOMPx7C
- TLSH
  T113B5BF1275E2C035C27E03305D18B28B56BEBEB409B4D76BBBAC151CAF74C819A577A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/uires/rtf/agreement.rtf
- Size 119KB
- SHA256 e10c821ab955f4f8e50b85292173da5e41f77142ecf14d1d8daa897a3eb0b985
- MD5 eaffed2bfdfbf79fd1fb1dee03ceba51
- SHA1 c14845770577e1bbf724da92041508790c1d0333
- SHA512 bfb6e770b22a185fb78542e2ad1956c2bd3918ce21380dbc3f5f6dd3be2255312ddb9afbff943ac8db43b45111df48d844d64440fefc457a2dd0e11700471adf
- SSDEEP 384:HXB8ncNWiu/omHVP2zY12mseQzNz/z3qLT9jQH3K/uONWq2YZpEhEpoGlfodUfnl:HucNWEx/EF/xWPMB
- TLSH
  T183C33903682F9A4D4F465A3A9B748D8A3969D502D5FA3058AF6E42EF9C1CD3CC2733D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16