2cd0a8c43688fe1e06b125d2d5ced2dbff2d21ab4566d3d221c7a858f5b23aba

Sharing

Copy URL Twitter E-mail

General

Target
PrismLauncher-Windows-MSVC-Setup-11.0.2-1.exe
Size 22.7MB
Sample260701-p189magv41
SHA256 2cd0a8c43688fe1e06b125d2d5ced2dbff2d21ab4566d3d221c7a858f5b23aba
MD5 d7ae7e9caaed05080553abf2ba89f5e9
SHA1 ca2ba2b37036c2e412a5bd53d1594eb21e534968
SHA512 b6538c0ae53ccead38764c2840fb4da404143ea4e80826fa13828f7665b62a3137de1745e43753f582c7a73157682ea0f8bcf43fe580c4e040a9a0e218bafdf1
SSDEEP 393216:tJeHR3eb8AWesgBCBglg21N3RYJzk8D2RAIACcspokbGH0uEvfSkxsGd0GoPOtOQ:twxU8tesgB9dhizk8D9CcsaH0TvfFxdb
TLSH
T1CD3733159AB09280E40C5A7C09E3F7B93657AD942D61315FF5F33C3BB37154282AAFA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  PrismLauncher-Windows-MSVC-Setup-11.0.2-1.exe
- Size 22.7MB
- SHA256 2cd0a8c43688fe1e06b125d2d5ced2dbff2d21ab4566d3d221c7a858f5b23aba
- MD5 d7ae7e9caaed05080553abf2ba89f5e9
- SHA1 ca2ba2b37036c2e412a5bd53d1594eb21e534968
- SHA512 b6538c0ae53ccead38764c2840fb4da404143ea4e80826fa13828f7665b62a3137de1745e43753f582c7a73157682ea0f8bcf43fe580c4e040a9a0e218bafdf1
- SSDEEP 393216:tJeHR3eb8AWesgBCBglg21N3RYJzk8D2RAIACcspokbGH0uEvfSkxsGd0GoPOtOQ:twxU8tesgB9dhizk8D9CcsaH0TvfFxdb
- TLSH
  T1CD3733159AB09280E40C5A7C09E3F7B93657AD942D61315FF5F33C3BB37154282AAFA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  archive.dll
- Size 716KB
- SHA256 dae15e297e4be332c38f257c4a21f337a6f9b20a1fd6fdce609c0c45b010c551
- MD5 d6e97f5c6fe1e0ce9fbedd1e12cc0503
- SHA1 b60373132c77316edb0a5450cbf566041805ffc5
- SHA512 469dcf0ea85663296ffd45bcdd19192f1c9f831aef9794d6199bf79bbfaf8b1c71655378ccd69fa66d8df29bf928f1a5bcb3c09960b5e08be578b08c97c85705
- SSDEEP 12288:qMSFVwT75qJOwJXSD46qTzWftKgQNjVEcNjzxwPuqCcmzics:/SFVwT75qEtXm8KgQNjVTNjzxwjnwr
- TLSH
  T125F48D82BBF40668E977C1348546AA27F3F1F0551760DBDF06A487653F23EE22A3A351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  bz2.dll
- Size 75KB
- SHA256 f843505d235aa7cb3ba48a0f159db5db4387cf02221eb2c1449d5fc0f943431f
- MD5 03324f7e57d24d37942c2952935a6381
- SHA1 2acd551a70710c7733117bdd3a2dbe5a8a4f1637
- SHA512 32ab97897711bbaaff8403a35d830de6e05530fd76475d3999936ed935881ba3e60896538a953800b2a26e511e3913996c1d40dca51abfb5dff1ced4d95e5f96
- SSDEEP 1536:RBVEJbODux1isWQ2d/ZGl3Ta5c/aBPEDDc3hTLq+ti8y:TuxAUhbrYVLqGVy
- TLSH
  T16D734B40B6A3FBBDDAABC0385623074BFF35BD680B1117BF3560967A2B22A910D74516
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  cmark.dll
- Size 140KB
- SHA256 6e04aa82627e6626491e3f13f65f14e8f4523cc8ace04fb1868266750d2019d5
- MD5 bb69690ad6e26abaa1eab2e27b4d67a7
- SHA1 2c009606abbb331d94a8080f9630934194863dc0
- SHA512 84188f3279d970a4a61a57523ba4685b0f17e13ef49d298f9a94273b7fade921e4b0dbbf8b41dc9944a63b536e79dca704c0aa7c9c838e8c31f60dde78b40eaf
- SSDEEP 3072:w5FnWcwoMEnY4Js2CVskFVtTmjq8yKEsj0oCLIiQ+:sWcBSGsvVlFVtaOmROEiQ+
- TLSH
  T140E34A96F5BC0066CC1BE07D4D2EE596E3BAB2173310C2E716400E65B9E7BE27636352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  iconengines/qsvgicon.dll
- Size 69KB
- SHA256 6221fed44f0f560a864312553c6918a536b8e2f04c7cb4e8ee5ba9445338aa96
- MD5 977a909b6d3ea33173e67f363ab63f16
- SHA1 ed82a046b6a1f7154400efad44e99e06a434f657
- SHA512 de30d97acdd124a512f0db3331d5352fed13be2cb0d7ced89cba703e016754bc703b2185e6af06c54b385cff989bafd53dc7f39e7a567b2e0ebfe8532a06a080
- SSDEEP 1536:KAaLoiOBXBqhM+buOxhBBZgig+poUht5nu2o5bB+imfbg7u0O:Va6jmZh9poUhDu2o5bB+imfbgfO
- TLSH
  T125637C1367A81449DC2BC63DC367861BEE72B4146761EBDF13A1C8362F67BC11AB8361
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  icuuc.dll
- Size 36KB
- SHA256 6febd789ff616dd6398ae2453adc1e7ccd7bbb6aee8c623a2638c1c00d51e003
- MD5 e9f9397709df3528c75c1d19fd64767e
- SHA1 2d392c946c58203679cd33aa463041639e9fcf91
- SHA512 304a41711e6247f6dedf50697c8429a92732bd8104f94dbc5589eb60700d50a835643f16d391d11850d48bf3309ec8f4e170e2ddefe776b5459b2ba3682f8bd3
- SSDEEP 768:/CFRHyCpCB+GgU77TuVnsDh7tm8T9T0qjT6IAqla1c3pmYj96mr:K/prGPh7tm8T9Z
- TLSH
  T1D3F2D60DC8084F61D3A7DB3F697D392F1922099ABF69FBB8EEB4C99441D520D20B5742
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  imageformats/qgif.dll
- Size 46KB
- SHA256 4fe24916a961587173c846055a34735b904900fb75716de4fa458c203da3e7ef
- MD5 c933629492717032aff2bc52c2829edf
- SHA1 3df3ba7f3bef412caf9dc309ab1634443922fc90
- SHA512 d763864e416bc5db12412b67534d07fb597145a5b479b3be527a17079fc1fd82acb4ca6eb77e8d0e764d17140581604076f9aa050b678d72cc4a8b3eb1ccf423
- SSDEEP 768:nGXTVMV6wdBj3lpVt/MSsk2OIEUcsohX7cocVW/5YiuiI5ALkZZ:QTVMkw3j3fDpP2pcsEX7cnWx7ulZ
- TLSH
  T157238C83ABA044D4D4638234D9964E2BEBB6B6244B92C7DF4221862D1F337C13E7D769
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  imageformats/qicns.dll
- Size 54KB
- SHA256 fcf2c00c959cdc7af7f7ac51e2f1158f37a76c166367bf30c4edc4e0657a835c
- MD5 d3c5d0ef185418015689d97a2c888797
- SHA1 b5aee11416ba575427ecc61ce39b408c26217f1a
- SHA512 a825c7ba279bb390a3f055cb786d544993eb1e795cc084c58c1321cf6f3063b6b2a600bd3fc9db49aa20c5206ce63a0475ed1cdc4caf6c19c6c2ca289fcf27db
- SSDEEP 1536:EOy2+up1dsYzCqj7JkO4eX6sOSVBpTJt7uia:zN+uGYzn7JosOSVBLtpa
- TLSH
  T190437C07D3918285D417CAB8D54A8A3BD772B4011B928BDF0265C92D2F733E27EBE794
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  imageformats/qico.dll
- Size 44KB
- SHA256 0d79934047e06591b74201d826af72f6ab595f5df4705ad7f0c234c0e2cf3a32
- MD5 7ad9178bbe3dc7276dc37682e012436f
- SHA1 db52b71eea1a577719e10365ad96b51fa6229010
- SHA512 e1fd52179926d7228fa465be42ec863cb026dbfac72a3341a1f026f178c70f2fcb04f8537231d88435becf29b83514d6cee35d0954d1180f21e2eea3f14e633e
- SSDEEP 768:LrYUBUjz9OXYC2x5XtuPvHeTLXwWs5Yiui7H5ALtl:JBUjz9OIP5duPvHeTLXwWW7u/l
- TLSH
  T101237B9396780489E927C678D8834E32EAB6F1605B92C7CF1265861E1F337C23E7C794
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16 behavioral17
- Target
  imageformats/qjpeg.dll
- Size 564KB
- SHA256 004f456d513a6bfc58320652c326a023fa8fea905d26b642a561f7081442aff0
- MD5 20152eb4b41cf308240b1768bc49f337
- SHA1 c93e5807adc9c70b9604ae679547bf84874fb2cb
- SHA512 4956448be2b65c6d633403315559d9fd5f7a67090f36187c7b76957574d3c0c15ae26e941a9891e0762c81e7b28ba6079d9362a59232ff8ad7353a25658c2ffb
- SSDEEP 6144:Gg2jrDdfz1PqtHuNRR2qvOpZGd/uyqM2sb5crHABKrS9rCpBkTZjM1UKllZqZvbb:HfrS9ECMre3
- TLSH
  T1EAC42942F6B51841C7A68878DE1AC966DB91781D03F98AF7B2D1CBD53B1BAE07B35300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  imageformats/qsvg.dll
- Size 38KB
- SHA256 b34f721be6e1a451a2eea3c146b0808091577143587d9e6bc689fe8214ff47d7
- MD5 7ee3b5552503b27a6ad2776a8fca2fcb
- SHA1 546a8bd11cd2f7aeaf37e3f971056247bfcbcc94
- SHA512 44e4b59ecb02a15e818fdc4fe2bfab26a7b70d88a724882bdba40d99ce41cf8352f93455432ede60142d57d1f5dcdcfed21beddccf5b02e51177b7677f8b2b24
- SSDEEP 768:8Si7nr/w0rAkuV2O4L5blG7uK5gSK5YiuiVi5AL9:8rr/w2AkuV2O4L5blG7uK5nI7uor
- TLSH
  T157036A47DB681846E427C2B4E84A4E2AE973F5514B62D7CF6262822D1F733C13D7C39A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral20 behavioral21
- Target
  imageformats/qtga.dll
- Size 37KB
- SHA256 c11ac719c2d7c50a4c2924ef4d439772176e00723e96f04d50d4a70163a9abda
- MD5 95291482f2dd14c88fa989dda454a90e
- SHA1 049589088f2194553e14ffd26b2f6546a5d4ba36
- SHA512 ff433baadda95c72dc1b8bf8575aa28e8a4a309195ccfe709b74cdc23d65140959c6718e982df674bcaf90acd970b246010ce93a6d8591debd4cb1054959b958
- SSDEEP 768:pkK60f5ksBejVX47kqfNZF5YiuiFPi5ALEA:C+usB8VX47kqfNZL7uIPiA
- TLSH
  T1D3038D53DE541C45D427C678A5829E1AEA72F1208B62D3CF6298835E0F773C13DBD3A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  imageformats/qtiff.dll
- Size 431KB
- SHA256 498e9259b9ec69a7f9a77e4ff796b9d2afcaa2e4c7c0a382b401f0b1c07718de
- MD5 217ec1613178742e4b8c285fd12617a1
- SHA1 224d488963d0c1686e1b2087327118b45a3ad2ca
- SHA512 f1c8673f8554cb4798c26136799af4d09a7455aa52716af28adbe66d0ebc87bf05d61a5142dc45aefe4b25a31729d550b74c184c58cb203df585e65df11c19d4
- SSDEEP 6144:q7b7GrJiM0yQB3WRL1yLBD3qmYxH3OvqEpTEEEEEE60HuoQ3DtRsz+dz4pluvbhV:069ZYmmGq/Q3DbnzGo
- TLSH
  T107949405DED049ABD872813955E7C612F2B3F4453B12CB8B9698B1353F127D029AB2FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  imageformats/qwbmp.dll
- Size 35KB
- SHA256 e3a1be02183ebd3c136a4554b34689cbb9ee6699278efda6944e9faf9c02f4e3
- MD5 365b862dffd1449269ab11704c8e5206
- SHA1 d8c88f6d5071fdb142e9b23138e8ab968433ab33
- SHA512 c688d6f1d7b972b1eade0303e529aa6a94998b24e02ab01af80d392b372acd2de366d24fd230e2931594a1005fa1762a3a8b82ce12882ff864936ccb12954044
- SSDEEP 768:NaVooyFmtxWX2xyjnl2OYomf5YiuiM5ALn:MLyExWX2xyjnl2OYomR7uQ
- TLSH
  T1BAF26B63DBA44881E527CAB9E4868E27DA72F5610B42D3CF2266825E1F333C13D7C795
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  imageformats/qwebp.dll
- Size 549KB
- SHA256 3fb2f8be5b82dada607ac9133a5139c770bd210145ea2ded90e69953b21a8d4d
- MD5 fbf2647d8dc1db68857d24d8924d8dab
- SHA1 8f7ac7d002113417eacb044d5de64b574dfeff8a
- SHA512 c289a111542d1313980f514bcf2f75af554a5cfc7d7d005227199eb3c96941bd34bab28651669454c83237e33c2079730b7ee5e0f32167dac2328b40cd3bcf39
- SSDEEP 12288:LWhkkMhPwLrLrLrLWCYNVh5+6Z9mxkn518sU:LWhBPLrLrLrLWCYNVhA6Z9mun518sU
- TLSH
  T1F9C46C8ED99623D8D49BC4B89AFD961BF6A53C1C434095EB17D0B9293B33BC05637B02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29
- Target
  jars/JavaCheck.jar
- Size 1KB
- SHA256 19a803401a128dd4983d30eb5eb804a13c129c980a28afdfe68428059f0f5076
- MD5 858b74093413c1a27c6b58b7255f7c34
- SHA1 9f079f34db8e2adc197628bc7ceceefd27950b7f
- SHA512 1e154337833b52cff0d5311faac08155d72ef2c1985ea59befc2b3b279930de467060284efb556c01e1496ad78b51f7e7afd27d9e485c0826009d2d50fd72e37
- TLSH
  T18F21F0657FE4C066F71F54BBDB00B253852B0124955D910303946A949D64BC55A338CA
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral30 behavioral31
- Target
  jars/NewLaunch.jar
- Size 13KB
- SHA256 40bcfd2cbdc0cc38457590d9fbb1875dad0705f23204d52feb8d114099446afd
- MD5 4eeb7d10c040b252920eb4f24923220d
- SHA1 57d619c1ffb84bedf1e3dc193cafc7ab1f24fb80
- SHA512 832cd1c66311a651f3571af1849a621fc4fb543711f2ebb7e7c697093d048c1267bd42e2a9d9fb1ebc9906d27b0fe8321e241b3788224bbe6a79e8d7f0ee7365
- SSDEEP 384:qUuAof8bfWI0LUaqeiW1w5Eq4kBMRYCmFbg:XuZfcWdbR2ENSO7Qg
- TLSH
  T1DF527C25EA93C8A5F55F83784AC587AF7C116680E0F171331FB29696582CEDC5E23F88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32