Overview

overview

8

Static

static

3

1.9.8c н...rt.dll

windows10-2004-x64

1

1.9.8c н...rt.dll

windows11-ltsc_2024-x64

1

1.9.8c н...64.sys

windows10-2004-x64

1

1.9.8c н...n1.dll

windows10-2004-x64

1

1.9.8c н...n1.dll

windows11-ltsc_2024-x64

1

1.9.8c н...ws.exe

windows10-2004-x64

1

1.9.8c н...ws.exe

windows11-ltsc_2024-x64

1

1.9.8c н...T).bat

windows10-2004-x64

4

1.9.8c н...T).bat

windows11-ltsc_2024-x64

8

1.9.8c н...0).bat

windows10-2004-x64

4

1.9.8c н...0).bat

windows11-ltsc_2024-x64

8

1.9.8c н...1).bat

windows10-2004-x64

4

1.9.8c н...1).bat

windows11-ltsc_2024-x64

4

1.9.8c н...2).bat

windows10-2004-x64

4

1.9.8c н...2).bat

windows11-ltsc_2024-x64

4

1.9.8c н...3).bat

windows10-2004-x64

4

1.9.8c н...3).bat

windows11-ltsc_2024-x64

4

1.9.8c н...4).bat

windows10-2004-x64

4

1.9.8c н...4).bat

windows11-ltsc_2024-x64

4

1.9.8c н...5).bat

windows10-2004-x64

4

1.9.8c н...5).bat

windows11-ltsc_2024-x64

4

1.9.8c н...6).bat

windows10-2004-x64

4

1.9.8c н...6).bat

windows11-ltsc_2024-x64

4

1.9.8c н...7).bat

windows10-2004-x64

4

1.9.8c н...7).bat

windows11-ltsc_2024-x64

8

1.9.8c н...8).bat

windows10-2004-x64

4

1.9.8c н...8).bat

windows11-ltsc_2024-x64

4

1.9.8c н...9).bat

windows10-2004-x64

4

1.9.8c н...9).bat

windows11-ltsc_2024-x64

4

1.9.8c н...T).bat

windows10-2004-x64

4

1.9.8c н...T).bat

windows11-ltsc_2024-x64

8

1.9.8c н...2).bat

windows10-2004-x64

4

Sharing

Copy URL Twitter E-mail

General

  • Target
    bd1e80b626ee34dd947ab8d96213de41dd20ff20cd28dd2a565a0b378edeffed
  • Size 1.4MB
  • Sample260702-apl8dsat6v
  • SHA256 bd1e80b626ee34dd947ab8d96213de41dd20ff20cd28dd2a565a0b378edeffed
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoverypersistenceprivilege_escalationransomwarespyware

Malware Config

Targets

    • Target
      1.9.8c новая версия - май/bin/WinDivert.dll
    • Size 46KB
    • SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1behavioral2
    • Target
      1.9.8c новая версия - май/bin/WinDivert64.sys
    • Size 91KB
    • SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3
    • Target
      1.9.8c новая версия - май/bin/cygwin1.dll
    • Size 2.8MB
    • SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral4behavioral5
    • Target
      1.9.8c новая версия - май/bin/winws.exe
    • Size 199KB
    • SHA256 affb4f69d2ea302a7abccd5325d81826e140ddae014f1e070bc4a6c0dd555188
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral6behavioral7
    • Target
      1.9.8c новая версия - май/general (ALT).bat
    • Size 3KB
    • SHA256 c6dff44ea3c7159788077e31a8e35929eab1c0270fb86f5490d44b1fd049a6fc
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    discoverypersistenceprivilege_escalationadwareransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral8behavioral9
    • Target
      1.9.8c новая версия - май/general (ALT10).bat
    • Size 3KB
    • SHA256 7a8b4d861c4448ee3fb4aef61d79bcdbfc3ea0ab043145f643539fbd177c8864
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    discoverypersistenceprivilege_escalationadwareransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral10behavioral11
    • Target
      1.9.8c новая версия - май/general (ALT11).bat
    • Size 4KB
    • SHA256 8df459fc47b6becbfd4cc54263ab99ee275a62c8a8097fb4abea236e29e7cc85
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discoverypersistenceprivilege_escalation
    behavioral12behavioral13
    • Target
      1.9.8c новая версия - май/general (ALT2).bat
    • Size 3KB
    • SHA256 94a8ef4dc67c5e04100c404604883cee6a7d8ad5d324395ecd71dc8ccb805d80
    • MD5 SHA1 SHA512 TLSH
    Score
    4/10
    discoverypersistenceprivilege_escalation
    behavioral14behavioral15
    • Target
      1.9.8c новая версия - май/general (ALT3).bat
    • Size 3KB
    • SHA256 99c06ea66bdade72d43febbf4e5bd6208351ebd471fa99a39a92253e21526c05
    • MD5 SHA1 SHA512 TLSH
    Score
    4/10
    discoverypersistenceprivilege_escalation
    behavioral16behavioral17
    • Target
      1.9.8c новая версия - май/general (ALT4).bat
    • Size 3KB
    • SHA256 feee3e7ecdbf3a5a46109b6018144954d793143ad4c889f3273f8ec1e8ac067d
    • MD5 SHA1 SHA512 TLSH
    Score
    4/10
    discoverypersistenceprivilege_escalation
    behavioral18behavioral19
    • Target
      1.9.8c новая версия - май/general (ALT5).bat
    • Size 2KB
    • SHA256 3e0a7026cccc02e6ca968dcd3efe4db94181cea190cecf4ac3e7e60d39d4dbb1
    • MD5 SHA1 SHA512 TLSH
    Score
    4/10
    discoverypersistenceprivilege_escalation
    behavioral20behavioral21
    • Target
      1.9.8c новая версия - май/general (ALT6).bat
    • Size 3KB
    • SHA256 8ef1e5f6ae38a7a288ba1516293eda9183d7f265210897399f911d8a1e7e62fe
    • MD5 SHA1 SHA512 TLSH
    Score
    4/10
    discoverypersistenceprivilege_escalation
    behavioral22behavioral23
    • Target
      1.9.8c новая версия - май/general (ALT7).bat
    • Size 3KB
    • SHA256 26b4dd29e5020066660230cf5ea61693dd85b69d15fc11ac967f3adf54fb352f
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    discoverypersistenceprivilege_escalationadwareransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral24behavioral25
    • Target
      1.9.8c новая версия - май/general (ALT8).bat
    • Size 3KB
    • SHA256 8612e0b0d5eb757448c4d2ef255abc00ff30f2b7e9087e0c936f7ba479af07e5
    • MD5 SHA1 SHA512 TLSH
    Score
    4/10
    discoverypersistenceprivilege_escalation
    behavioral26behavioral27
    • Target
      1.9.8c новая версия - май/general (ALT9).bat
    • Size 3KB
    • SHA256 4b8f50bd2b5cd71c0a883461d4a526a2cd9494a87847907807d06c233166c2c9
    • MD5 SHA1 SHA512 TLSH
    Score
    4/10
    discoverypersistenceprivilege_escalation
    behavioral28behavioral29
    • Target
      1.9.8c новая версия - май/general (FAKE TLS AUTO ALT).bat
    • Size 3KB
    • SHA256 0a3744d9a42dd439b3576fa1d031d3d2ef6f93564bdb575a6afb0c8a3a056ac2
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    discoverypersistenceprivilege_escalationadwareransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral30behavioral31
    • Target
      1.9.8c новая версия - май/general (FAKE TLS AUTO ALT2).bat
    • Size 4KB
    • SHA256 1e9a3d1fe257f10c9355dbef5a45cca9765b57e2ce1f549225c68c86ff1c8d8b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discoverypersistenceprivilege_escalation
    behavioral32

MITRE ATT&CK Enterprise v16

Tasks

static1

Score
3/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

discoverypersistenceprivilege_escalation
Score
4/10

behavioral9

adwarediscoverypersistenceprivilege_escalationransomwarespyware
Score
8/10

behavioral10

discoverypersistenceprivilege_escalation
Score
4/10

behavioral11

adwarediscoverypersistenceprivilege_escalationransomwarespyware
Score
8/10

behavioral12

discoverypersistenceprivilege_escalation
Score
4/10

behavioral13

discoverypersistenceprivilege_escalation
Score
4/10

behavioral14

discoverypersistenceprivilege_escalation
Score
4/10

behavioral15

discoverypersistenceprivilege_escalation
Score
4/10

behavioral16

discoverypersistenceprivilege_escalation
Score
4/10

behavioral17

discoverypersistenceprivilege_escalation
Score
4/10

behavioral18

discoverypersistenceprivilege_escalation
Score
4/10

behavioral19

discoverypersistenceprivilege_escalation
Score
4/10

behavioral20

discoverypersistenceprivilege_escalation
Score
4/10

behavioral21

discoverypersistenceprivilege_escalation
Score
4/10

behavioral22

discoverypersistenceprivilege_escalation
Score
4/10

behavioral23

discoverypersistenceprivilege_escalation
Score
4/10

behavioral24

discoverypersistenceprivilege_escalation
Score
4/10

behavioral25

adwarediscoverypersistenceprivilege_escalationransomwarespyware
Score
8/10

behavioral26

discoverypersistenceprivilege_escalation
Score
4/10

behavioral27

discoverypersistenceprivilege_escalation
Score
4/10

behavioral28

discoverypersistenceprivilege_escalation
Score
4/10

behavioral29

discoverypersistenceprivilege_escalation
Score
4/10

behavioral30

discoverypersistenceprivilege_escalation
Score
4/10

behavioral31

adwarediscoverypersistenceprivilege_escalationransomwarespyware
Score
8/10

behavioral32

discoverypersistenceprivilege_escalation
Score
4/10