e952605acbcc70e1f015b15928b3f13b46a49fa74dc962805c9d41d80e5b56ed

Sharing

Copy URL Twitter E-mail

General

Target
supermium_144_64_nonsetup.zip
Size 167.7MB
Sample260701-lzqjcaa16m
SHA256 e952605acbcc70e1f015b15928b3f13b46a49fa74dc962805c9d41d80e5b56ed
MD5 c496fcc8a048914bf0131d7a3d0f8d66
SHA1 ccb4ad0c42b37292752449ff7c615134ba97f270
SHA512 ec548bfcf87fbb6fb5bd9819ca38798353196fcab3dbcf729fd1cd446b8891622fb1f4cb41d0326ab56eb53eb911353975a3167bb2292011edb77193f6a8cca7
SSDEEP 3145728:UOPBxCrv8zBC2BJB8aDkssvyiv/sCZ9nxsFnnl6N1aU8ZD3My81/5RCFaakNQcVN:UOvCAz023aaDksRXFnI1PAoyC5gkDg/6
TLSH
T1D88833DCBC54924FEAE8A67B65DB0F714093B70B9C510D334DBE26CCACB2A24066315B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Supermium/144.0.7559.252/Locales/mr.pak
- Size 1.2MB
- SHA256 e56ee44653c34ac8c884cf7d9aa0e0d6f2417ce78c98686f079d8623d61db834
- MD5 c744fa631004bc54f83a3a756ba00686
- SHA1 a636daa605e076834ffbcbeb13660b040897beb7
- SHA512 746613d9972d3cc33cdc35e6b1a8f446e6eb1de83e19c607af3b5fd644b21f649dae330b722083fb44a9bbd8c09bf182a262d29546dd26d495b79bd66ca5b5e5
- SSDEEP 6144:lvpMjqfAV9ERauvbyh7CYiWU6vsiVHN9mn6RR:lhN8upvb2/JN9mn6RR
- TLSH
  T16745D24DF77AF3685DACBC8E36580D3BD8FD21B1C3E9925648E1B3E74884CB401596A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  Supermium/144.0.7559.252/chrome.dll
- Size 238.1MB
- SHA256 dc25d6376dde8c31ebbba825ce2e743d7c70c31b282eec00971152387deb2efd
- MD5 bc037586801f21214909c892a64cdcf1
- SHA1 882d95016029a45a9222121cc27d36022b72b213
- SHA512 587c418ec4281eda8d3d6f85192eb86dadae96be64857c7df90734c96ceca6d964a0732e5a09209e0006cfc52bdaaf4c4a628ad30e547ca0f93edf33a8c05082
- SSDEEP 1572864:6qWMVzfBzygjzD08lesfIhRg909CTmIILpN98C69Me+paGAZpFdozbXX3dQHe8Gg:bMTudfGGaS40Cu4Qt
- TLSH
  T1CDC87C03F2AA41D9C06DC1B997469233FEA1B8494B24B3DF1B515B522E76FE8273D720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Supermium/144.0.7559.252/chrome_elf.dll
- Size 1.3MB
- SHA256 3d6bef06a0096d9711f999573e0e52f8c83347d5a744307969628134e7c387ad
- MD5 8020ac3bfe4ec3a5ffde03be1cfb9b92
- SHA1 4dd3f68fc194f854f5a883f48e760ea9ce5fe4c8
- SHA512 8813d2fce0242a1125cad38a341dcba9611038e5db6b4eb1ac0eefe79e0ebfc3efbe5547fb9cc9cd769a6947db39e9930921be590391d6f1c0bde49061ba441d
- SSDEEP 12288:a+Pq90ptO3Nqae7yGwV7KEWl+d68rzMbKcEOhSNOs2BEy2sWodg4p3we:aCtO3ZkyGwV7KEI868rVNOs2aye1w
- TLSH
  T15A558D17B2A501ECC06DC17887578632EA71BC464B34B6EF0AA8B6551F76FE05B3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Supermium/144.0.7559.252/chrome_pwa_launcher.exe
- Size 1.4MB
- SHA256 b09da062bedebe7e0363c97ffe328a836fbbfcdae754320f73e6c23ee372e216
- MD5 ec6dd93b8cf91af7bf653ef87a5a3036
- SHA1 10b696f6d5567f4fd063bf92f10789cd05a2455b
- SHA512 bdabd6c1e57e495ff46842aa6e82f4388b5bc2a3bdb63314dd819588e070c9e7183b342982a347fafebd2e11f7c45895472c38346f98c3fddd5db016c003c413
- SSDEEP 12288:5hTkRhFvEOGP4wR8h/lZl1FlUltZzWmKpYTQ0wOEdsAnds8PLMo9kgpUXm:550aOZu8h/lZl1MltZqmkRnds8on
- TLSH
  T1AA657C377297D1D4C41D90B0CF260AF155A17CB9CBE697DB01C87E24BB329E07ABA219
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Supermium/144.0.7559.252/chrome_wer.dll
- Size 107KB
- SHA256 fdba260431e36c2399aafba17022ff10c0af8f8ea6ef65af091b7c07e987a0fb
- MD5 ed7e2650e2b00e5a2872f274b73915f0
- SHA1 503d68fa867c3b074900c4ad46552a0f854b385c
- SHA512 9cbdccff7e7ab3be3736f1d033cf6fd63e136835af4ea6891b2e2094207620bad1650e67e224a434e5d340e720da9893ae36e0e31bd0f30c4f778a61d6f095b5
- SSDEEP 3072:cP6BQOmqhzoAlkjQJ+9+BvpPmxGMNCmyo112:G6BQlIs/g+9+BvFs
- TLSH
  T1AEB3396767E640BBE1B7427884634E05E772B8124760AFEF07A4466A1F237D09D3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Supermium/144.0.7559.252/d3dcompiler_47.dll
- Size 4.5MB
- SHA256 8ceaf4c75fa714bd7d4745b99a2e10867c91f98150a74912f1bda9560a39dd18
- MD5 717d5bef03324b0b13370e471fa63041
- SHA1 a39cf8d74a710c6ac6b0241e5b1965665537d7c3
- SHA512 99ca414bf0a482b1ca68e14ea6703297f087c6d9f30cd45b73039fbfe2f90fea488ad1113d772e781cf22b633bd11fc073636e670f0a2314e23cb754ecb16282
- SSDEEP 49152:pUFq2GWy9ELzDQryMVDLsebrpVnA3GCdGNCxJYrv9ypEze+V7Zpd6ekkM/Q/qx6P:qu9EUrvSmMyzrCTruF
- TLSH
  T129268D5677E840E9C57BD138C687835BEBB1B80413345BDF02508669AF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  Supermium/144.0.7559.252/dxcompiler.dll
- Size 24.3MB
- SHA256 b66932968f096d45234d0aa59474686d5ba66a74133ad61390921876911c63d6
- MD5 db7e91b6246874fe6b5335ec5b40135e
- SHA1 a04d101b522b829d4dd409bb66c3bc686701fedd
- SHA512 b5fa54fe6219defcd965b20b845077cc59569fce0199f9444391e66778e60c6992fe2c8a36a65a94421e7300f57594892d6e848479fb5c831ee1827ef5ac0f1c
- SSDEEP 393216:EwARLtd2QnYv8iNL0c0la4wg6Ol7b7A386tg:II8+oC4wg6OxI3o
- TLSH
  T190473A122646D49CC099C879C7678B268A6C30E73FA7B8DFC0F451252B79EBC5B39235
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  Supermium/144.0.7559.252/dxil.dll
- Size 1.4MB
- SHA256 9cc2327250299b9f60016408092831ec35509eaa3cae02578a598c589f6e2b38
- MD5 710863d63df9dcb8996f7918624a8581
- SHA1 5d362e9debe2fec098a50e55a4b9327d4d778096
- SHA512 d1d5cf00b5b6f48d0594fa27213afd0f87ad9a4351acd4c2b340c121bafd430446147a5278b585a1e18bb7036b50bd52ec7dcbb2a559d470ed25d3cda8661944
- SSDEEP 24576:bY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5zaa:UiTMYxy0Sy66Zh7Sh/cyvS53
- TLSH
  T146657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  Supermium/144.0.7559.252/eventlog_provider.dll
- Size 6KB
- SHA256 a582d0f840be98d70af460b711366053e777ea623a1b1cdd599664dc1d27fae1
- MD5 9d8a1d23fbf95f214ce4a1193e489054
- SHA1 59c630eee02bb7886f342755f68a0c649409dcbe
- SHA512 34ad62914763c6764671846929b1630856a6c49deec35af09d2565fdafa2034aaf854ccdfe7f3eaa34ab2cd7d05187d49369afc6b417bb48c88c0612508ad2b6
- SSDEEP 48:vpg1x/N4ApiqqJY4WVnKl5+GKFt9wWY9aE:B8UqqCZW5+dWWY9
- TLSH
  T1CCC11313ABF80529F1FA0B3466771B41B238FDA1572583DF06A2110D1CB4BC5AC71BB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  Supermium/144.0.7559.252/libEGL.dll
- Size 476KB
- SHA256 808d052047ece8bf2af132b1cd2b3f0b14424832011a27437d7cc89d7143f03f
- MD5 c318b1c96492f4683437f9c768d130ac
- SHA1 eab8358490e0437994ed08f0eba5983da630e155
- SHA512 4197ae2d8562c798d18ea174e5463932dbf8ac758326b205da456c22960a72f08b69d65462becb11dc515f0b046950bc0c02e0d37b80f821c858222367832fb9
- SSDEEP 6144:88RqW6ZYQwgv1SzroRqG+Jc5p1seoS+iV9Ik:sYQz1nRqG+Jc5Xs7S+iV
- TLSH
  T1EDA47D15B6E559B8D07BC034CA538642EAB17C860B61E6DF02E0E2762F777E05B7E321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Supermium/144.0.7559.252/libGLESv2.dll
- Size 7.4MB
- SHA256 aa8a3b73d349b4dc93ba283de01aa25c29ea8c0b5cac678cd2db4868426d0b79
- MD5 b338864fe9999e0048680f24fc11a15e
- SHA1 97c90b326175647deabd1d15b2d02b0f76b6e0d9
- SHA512 387c0936d6d1ecdb54eb8d3518915fe3a5b49eae77d5d318d03e357bbedddbe459f891972792904528d21103cd8fe428f37126faa98f15ed8f6b7117f8a50f01
- SSDEEP 49152:XbCgS0faQ/TjiS+4OzaUlabV4g4khItnRu5R9m/eeMQoxhtx9sfs3p1+TVMesnex:XbCKb+KxRU/e5rL5Cqfeb4di0zKDrk
- TLSH
  T1B2767C13F2A240DDC01DD2B8875B9627FA71B8450724B3CF2B9467162FA5BE0AB7E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  Supermium/144.0.7559.252/notification_helper.exe
- Size 1.3MB
- SHA256 5bcdd2fa36a956d8926839718f1d98bcc03085dfef23ac74106f1abe062f9838
- MD5 75c9f67335eddd375f439bee0f4d5908
- SHA1 ee65d3a2b88122040fc75b49a7383061ba3d534a
- SHA512 433344e578a32232d012b9caecfd1224bf1ada8793d449dce00b8ac9f1c948b5602e5080034575fb220bb2d6842643f8b68fe4bc516b8a576ac744aae04ae2a8
- SSDEEP 12288:M4YWogZF81/XO+T0DDKJk5wNHOfXbBoz7ogHrLq/8OydPNosVIsKGVo3PRy:MtIWXOP/Ik5whOfXt+ognP6sVLMs
- TLSH
  T1CB559D13B2E501D8C06EC07987668632EA61BC464B34B6EF0A98B2551F37FE46F7D721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Supermium/144.0.7559.252/vk_swiftshader.dll
- Size 5.1MB
- SHA256 aa83bc31eba02e55d819e6ed1ac83d43eb7545fc08fa38fbd5790ae85a1f3c39
- MD5 8ce48fc840d7bd2676b6a848263cd612
- SHA1 1e628a69cfe12d29dd06b1d46bb36dff056cb503
- SHA512 fc42841f5fffdc6b34df090966b5de6a14c4cc20b509d717a5e7738f0b91eccde7e542fbe5d644309cf8184978aa4879bacbe1cba7bebf1b0ae47f4347d3b1e0
- SSDEEP 49152:X34o6IQDFeD0dqRlbYiLUW0f4u15aHlcFweugWXCNcA1tE0J2qgz//nQRRUtGn72:Yo6tto6Mu7dktU
- TLSH
  T1F5464903F29680D9C06DD579876AA633B231F8840B7276DF67A05F192E6AFE0673D305
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  Supermium/144.0.7559.252/vulkan-1.dll
- Size 892KB
- SHA256 4e8d0a792eb39b8e09aea8483974c9c912811d7b62d0f298d01b7585f48df3e4
- MD5 285e8ede17993fc15a95d8ae73de4636
- SHA1 fbfc20f9bd03d0f29d644f25ccc26f49ecd3f9e1
- SHA512 3ea872b34742ab25e90cb295d81300d9e7b0457b982fd671ebd998dbf6018ea98375ae8d96b3435cebce64a254d5cfda1a70c7f13ea7aecdff4d201f165d9748
- SSDEEP 24576:QYGxvCKoB2T+kgfssq+6Z5WGcXDYsHQDJ6g3P0zAk79oOH1OWhI:1ICPATDyssq+6Z5WGcXDYsHQDJ6g3P0E
- TLSH
  T125157F329A540A69DA76C034C9D2460349F178922331E9CF02F867157FBAFF46B7EB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  Supermium/DWrite.dll
- Size 2.9MB
- SHA256 10983f3b7f3bb8076443ef5634bfc0b68eefba4205f09a7af5f9a7412477dd37
- MD5 be3f0c483b715ea5aadc7db27401fb03
- SHA1 9976427a9a3372623afcffcc48a926169a3fd10a
- SHA512 58913867413bc2e774f7a324cafef93df7ecad2a8be2dc57b968a5cda5e263684c9c077473ab7bd5ffee724374da17ebaf3a0e367dee8344fdd447e1c769bdfe
- SSDEEP 49152:jwHg8YC3IsK+RaFCbwVI8accA8222Uqm8:A95qB
- TLSH
  T1F0E56C47F55A44A9C16AC034C6878627E630384A8732A7FB2ED05628BF677F35E39F05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Supermium/Supermium (Classic Portable).cmd
- Size 248B
- SHA256 2a208c5668b12b99d1d1e50572cf24770bcf2b2c2a849aff7e16ad42fdbd8b93
- MD5 b4d752e2506773ebb291f6ba4e296e1d
- SHA1 0f0459bd3e98f77b6f5ae5cbe3f4534ee645e743
- SHA512 4070352a4b67be5a93f1ed8aae55f4228fc0036532bd3a9e3a64882c4f0a1a969cd22c85b0a771d92de0aed4ac1b378d4bff2e4200d5ac8ccbf154701803c2d5
- TLSH
  T1E2D0974EB140BC2C380FE4323C2AADDB6F317E86930C1A2122241DA84FEB0A0421FDD2
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery persistence ransomware
behavioral29 behavioral30
- Target
  Supermium/Supermium (Classic Ungoogled Portable) - Copy.cmd
- Size 270B
- SHA256 f024d85193228c70929bd0dfe250875d8972e35076222ac55e29150fcc13963f
- MD5 a5a1b34e9a809e030148c28f7d7b93ff
- SHA1 4a25e91cb6ac9cb96ea70413f83ee32ccd9c056a
- SHA512 2792acccf947a6d445c743c6e5faf22c40c089e4db0f82e01455784c77a3be011924c650983ea1495d8823be5fec8a15b8317b16ed8c2afa8dfd3b08e803caf4
- TLSH
  T160D02B4E71407C3D640BE4623C6A9DDB6F213A865309551121241F584AD7090422FDD1
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32