622e164f293c828d5e4ec182db46c2f8a663916d86048240bd6e868a51f39738

Sharing

Copy URL Twitter E-mail

General

Target
Windowkill.v4.0.6b.zip
Size 111.5MB
Sample260701-qv2s2ahv2x
SHA256 622e164f293c828d5e4ec182db46c2f8a663916d86048240bd6e868a51f39738
MD5 cdd6be95e2317528013d4da7296eface
SHA1 09e7d9d13e8b6fffcc1284f96464849c79b93997
SHA512 bd2d3d2884811a8a4176fa12bb46277fab6f601946d60b674ba4e2fb59c4fbbc3dbf26b826a22aa09ed89b46ea9a1bdcf12625bf47e63714b1c66dbcb78188a5
SSDEEP 3145728:0WwPYURcYmF1UyLFuSa/Ykp+ZgXCi3JA2a+:0WwPBcY+zJuT/YkUZgXCi5A2a+
TLSH
T1C1483313E35A814EDF6338B242D1FA0D9E96E65762669533E31DCE420F2BB5107B8B34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Windowkill.v4.0.6b/STEAMUNLOCKED » Free Steam Games Pre-installed for PC.url
- Size 52B
- SHA256 677d2e85447eea64fa541b8e8a9e92b41e20456360bef8642f898e7eb1b2f0db
- MD5 92672216743fd0ad8799d25ec99e5096
- SHA1 68103be0fa83db8a4a2efac6bb6169ce959a0290
- SHA512 1ca286141902e64c4cac05fabc1ce0ef4d910582e720c8b38f3cf2799cadaab7cbc9d8fc925eff17e0d3280d5d074ebd856dc75d6cadbd95872cae14eddb7719
- TLSH
  T1299002574119C05D9316084C8411955689426199456AC4A4D241DF0D5D8B1589AE4708
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Windowkill.v4.0.6b/Windowkill.v4.0.6b/custom/skins/sad/bg.svg
- Size 499B
- SHA256 72e923b9704fa0c58f73400386161001eb82ed77bec9ab3c95deb96145031609
- MD5 a7b1b89d5017d539d678d2b7d8861ef0
- SHA1 ec065608f9b6f2183b6076dd0d062ccdac583ce1
- SHA512 b0c4b9dfd83fb8b1dd90a9ddb35666cd30f77833f470097fdda62c130ef07fb5784abbca968c4ce560ccc65ed4168f377f67cc32f06a4f1b535ad93edefff8d3
- TLSH
  T13FF0E924319C6C2C7A194618876F323A7A5A6182CB4ED116B0903D76AC0146F38969FE
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  Windowkill.v4.0.6b/Windowkill.v4.0.6b/custom/skins/sad/fg.svg
- Size 233B
- SHA256 ec1dc2bad8ba5963977a9cb4dfb17f60acc434dab32c37a94311c57915528037
- MD5 bc5d26496e8a0c166c7a8595fab168e8
- SHA1 33e5037529089ba7ced6f7f54999935b06ed450b
- SHA512 836aa767e00a51eabbf850e992cc800ce13d7bd48a8ac519c45f3ce056a7dd75af9a96369e097f61316bbafe510a465bc316535b3fba2830a20cd5e7e25b7afd
- TLSH
  T1FED0A73C111CAD29E158C10CE73F305C547E70009B8D5656B5902C31B10A55B38372FC
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral5 behavioral6
- Target
  Windowkill.v4.0.6b/Windowkill.v4.0.6b/discord_game_sdk.dll
- Size 3.3MB
- SHA256 a6b6d7df00a58dc50248d91048578d0fe52182286b487ef89a961fd10467dbd1
- MD5 4402cd4891c256ee40046c6092afdcbf
- SHA1 914e01743c7591beb79a61417b262caeb23e2c20
- SHA512 78da4181132a02d7d17ba4b2839018dc43d7d691c8bb01d34e5f7439df9c92951ce687e9487df158c44e764275b45d6800f6629ec2a175cc4ecdf868292291e5
- SSDEEP 24576:Q/NGmO/w02OFM7zWIyjQYS2tBMPfL+8T14rbXojA4F8eEcu2sqhA+cGRlZVIH06R:3oOiaQAtBMPfCn/WDcGRxIU6iIdAk
- TLSH
  T1E8F539217A5A646CC0AAC474838B4A722A3138CB1F35BDFF04D595793F69AF46F3D218
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Windowkill.v4.0.6b/Windowkill.v4.0.6b/discord_game_sdk_binding.dll
- Size 401KB
- SHA256 93113022caba568464712c892815beae865f7caf71443486de9e1ff61d38c065
- MD5 e237d3f342d7df826906a896b9607af0
- SHA1 d7a794a7a7dcac6d973c3958f42b23fb5d05ef60
- SHA512 4da2e40cf26d5eafba4b9c21275425f8488e88efe5d749d3ec4bb5b6d02f7d100e1b4b4b222c2cf71ec09298f32511922761c57be3f70a6b2bee7a0b4fcc1875
- SSDEEP 6144:puwQUBMq+9zKNr6fR9cf4PmaHUJBXX/FLyEKh6R3fet:puwQUBMF6r6g4Pmo8B/FrKh6gt
- TLSH
  T15C945C29E34016B9E437E138C6930A16D5F279C453708ADB13AA066D8F33FE69B3DB45
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Windowkill.v4.0.6b/Windowkill.v4.0.6b/godotsteam.x86_64.dll
- Size 1.6MB
- SHA256 0eff4b044b1c8033b6c87f038f3a4369f049f556c50c94c756553fa5486cd025
- MD5 b84a554953c95a27757cd188fe4568f5
- SHA1 015a2b3b5941ad20dbadd5306d58ee83a97909fb
- SHA512 9bd51587134dfff8818e6206ba8a2700bb04aba6e4eda814d3d0b29491041c3d3c007f1cd6de1d2dec161f8e33bdd2c6fe4f40d8c27a9e2a6ae0b3946bee5c55
- SSDEEP 24576:pbp8ibjn+NCp70vMF7VCezaJGsN8qfMACg42u2t8HoQu4bTmJM0Rdy:pbpWNBUa3N8qfMAxZbtyoQuOTmC9
- TLSH
  T11E75F543231843A5D122D2BACE531106EAF07848FB39BEFB5DA65D482F2BBE1553DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Windowkill.v4.0.6b/Windowkill.v4.0.6b/steam_api64.dll
- Size 294KB
- SHA256 9d6d2972c1571a2a058d79a8376e26a33d33813f29d93c3ca6e35adaddcd56de
- MD5 36f023155d9357e4c9c61af2e340abfe
- SHA1 48a9b3fd2670bb743e366da9203238a4fc69f903
- SHA512 6c13fa116eabbb6a1fbe9b5f8625910208a44c41103f9407a093328d00a682cb8a96d39356b76439b432b9b63f216288b044ecd1097ffc34c7f1bcd68f79e886
- SSDEEP 3072:M1mXZxtdMVhdbt9OFeX9qctF+nlD7Zh+iJba+RFSME5lhTbCCwGY2dbvIQEkyI+c:MMZTqJEK9TtF0hZI8Rsxvy4O2CH4SDKH
- TLSH
  T10154597AA2750CF4D076C13988565E0FF6B1745B23219EFF226053368E57AC21E3BBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Windowkill.v4.0.6b/Windowkill.v4.0.6b/windowkill-opengl.bat
- Size 48B
- SHA256 85ceda9964a27ace110aaaa8f98acd07ece65aa2789c3e5b1dbbfba983fe2be7
- MD5 f0aa2640635a4606a43c5a42a8998fe5
- SHA1 8c80e7cf252c78b7888a412819a72c1c0820c634
- SHA512 efd4db96dd5855db417ddf427401b36b0ab2ffd480cc96d949725fd2ba06744540be6ad4c2acc8ea70417cc94109de6646de295efd3eaf01a7def8c1a2ff3d81
- MD5 SHA1 SHA512
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  Windowkill.v4.0.6b/Windowkill.v4.0.6b/windowkill-vulkan.exe
- Size 102.3MB
- SHA256 60c0548fd64111afab67b9342c16c3fd179859d9ddb5d4be82bac9c76031a217
- MD5 0530b3aebfbdf5c32e8662daac8e7734
- SHA1 d5966c8ab9a60aef2de818bb1fbe3d8a1089f254
- SHA512 a7e0a8ddb228e1445c40b09c2083992a47f5b39a92edcf1a228bbcda297155363d4ea44abe372b2eeaffce2930f45e81155b333f207efa284c5e01fa60a71e71
- SSDEEP 786432:uc0HAj6rQGuh+ncqiwo/0Gz+seCJ7F/UFCkTRqEYgu1Dur//DE5P0kS8FAglOzmp:uc0HAj6rhuhqcqHGHFZmt/utu7Vgxp
- TLSH
  T10738BE83A2F912CED167C63587076017F6B0349523304BFB15744A6CBFB3AB66A7E246
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  Windowkill.v4.0.6b/_Redist/dotNetFx40_Full_setup.exe
- Size 868KB
- SHA256 fa1afff978325f8818ce3a559d67a58297d9154674de7fd8eb03656d93104425
- MD5 53406e9988306cbd4537677c5336aba4
- SHA1 06becadb92a5fcca2529c0b93687c2a0c6d0d610
- SHA512 4f89da81b5a3800aa16ff33cc4a42dbb17d4c698a5e2983b88c32738decb57e3088a1da444ad0ec0d745c3c6b6b8b9b86d3f19909142f9e51f513748c0274a99
- SSDEEP 24576:+tW4x8xAxCdUcyezFSjaBHFaNlsqK5/oh6iZf1LUXw/vxNI:d4x8xqCGexm8FCspg0iZf1LUXD
- TLSH
  T1F2151232ABA0C133D4DB28B48ADDB6B2657DE6610374C4C7B7440BEEAC307D1697964B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral19 behavioral20
- Target
  Windowkill.v4.0.6b/_Redist/dxwebsetup.exe
- Size 281KB
- SHA256 111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288
- MD5 fd6057b33e15a553ddc5d9873723ce8f
- SHA1 f90efb623b5abea70af63c470daa8674444fb1df
- SHA512 d894630c9a4bdb767e9f16d1b701acbdf011e721768ba0dc7a24e6d82a4d062a7ca253b1b334edba38c06187104351203a92c017838bdd9f13905cde30f7d94d
- SSDEEP 6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc
- TLSH
  T1F154F11267D9853BE0F56B705DF341236B75BCA15E7AF32E5246A88C0C32784B83A727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral21 behavioral22
- Target
  Windowkill.v4.0.6b/_Redist/oalinst.exe
- Size 790KB
- SHA256 b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
- MD5 694f54bd227916b89fc3eb1db53f0685
- SHA1 21fdc367291bbef14dac27925cae698d3928eead
- SHA512 55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5
- SSDEEP 12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV
- TLSH
  T1E005F10020D5CC73E4EB32B3843586746EBA7E912F0A285B7FC476AEE673176DA71215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral23 behavioral24
- Target
  Windowkill.v4.0.6b/_Redist/vcredist_2015-2019_x64.exe
- Size 14.3MB
- SHA256 b6c82087a2c443db859fdbeaae7f46244d06c3f2a7f71c35e50358066253de52
- MD5 f0248d477e74687c5619ae16498b13d4
- SHA1 9ed4b091148c9b53f66b3f2c69be7e60e74c486a
- SHA512 0c373b06ffe84f3e803831e90f22d7d73304e47a47839db614f63399ff1b7fcf33153bf3d23998877c96d2a75e316291a219fdd12358ca48928526284b802591
- SSDEEP 393216:q5lptVYmfr7yBG/4WoI+j6LTinXKSf0fzTDv8:q7pttD7yBG/uljIinXj0fQ
- TLSH
  T1AFE63332A598402BDBF20473EA94F9242E3DD119735589BBE2DCDD0E1F7818217FBA16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral25 behavioral26
- Target
  Windowkill.v4.0.6b/_Redist/vcredist_2015-2019_x86.exe
- Size 13.7MB
- SHA256 ac96016f1511ae3eb5ec9de04551146fe351b7f97858dcd67163912e2302f5d6
- MD5 de34b1c517e0463602624bbc8294c08d
- SHA1 5ce7923ffea712468c05e7ac376dd9c29ea9f6be
- SHA512 114bca1ecd17e419ad617a1a4341e607250bcb02626cdc0670eb60be734bbad1f3c84e38f077af9a32a6b1607b8ce6e4b3641c0faefaa779c0fec0d3ac022dac
- SSDEEP 393216:/d/FlptVYmfr7yBG/4JU4TRjtjUMy4i6kgsY7i:/1PpttD7yBG/QHTJtYMyke9
- TLSH
  T134E633326554402AEBF20573AAA4F5342E7DE62D230449AEE3DCEC0D2FB919357F7612
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  Windowkill.v4.0.6b/_Redist/vcredist_x64.exe
- Size 5.5MB
- SHA256 b06546ddc8ca1e3d532f3f2593e88a6f49e81b66a9c2051d58508cc97b6a2023
- MD5 630d75210b325a280c3352f879297ed5
- SHA1 b330b760a8f16d5a31c2dc815627f5eb40861008
- SHA512 b6e107fa34764d336c9b59802c858845df9f8661a1beb41436fd638a044580557921e69883ed32737f853e203f0083358f642f3efe0a80fae7932c5e6137331f
- SSDEEP 98304:EuLgywiNHBeSLxYK/bxE3q/BlZkWMGPQflVJ/EK1sLyzs2T2Q1mOjq4/:V7wqheSVYK/bua/BlWWnuVhsus8nm+qi
- TLSH
  T19A4633229343E243EC97FEB8E16E484FDD65C2B31736D6677326848D9D3DB1848A0399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral29 behavioral30
- Target
  Windowkill.v4.0.6b/_Redist/vcredist_x86.exe
- Size 4.8MB
- SHA256 8162b2d665ca52884507ede19549e99939ce4ea4a638c537fa653539819138c8
- MD5 b88228d5fef4b6dc019d69d4471f23ec
- SHA1 372d9c1670343d3fb252209ba210d4dc4d67d358
- SHA512 cdd218d211a687dde519719553748f3fb36d4ac618670986a6dadb4c45b34a9c6262ba7bab243a242f91d867b041721f22330170a74d4d0b2c354aec999dbff8
- SSDEEP 98304:RuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOR72HgQo0z:I7wq1W6HqULS8djZDTaNNeCKVP5ORsg0
- TLSH
  T1D3363341B7A660F9D20778B256377FDB1C28C2CC7B28130AA365E5E87ADB7C08355798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Checks installed software on the system

Drops file in System32 directory

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32