Overview

overview

8

Static

static

3

R6 AI Release.zip

windows10-2004-x64

1

R6 AI Release.zip

windows11-ltsc_2024-x64

8

DirectML.dll

windows10-2004-x64

1

DirectML.dll

windows11-ltsc_2024-x64

6

OverlayDLL.dll

windows10-2004-x64

1

OverlayDLL.dll

windows11-ltsc_2024-x64

1

Redock.exe

windows10-2004-x64

1

Redock.exe

windows11-ltsc_2024-x64

1

best_fp16.onnx

windows10-2004-x64

3

best_fp16.onnx

windows11-ltsc_2024-x64

3

kdmap.exe

windows10-2004-x64

1

kdmap.exe

windows11-ltsc_2024-x64

8

mouse.sys

windows10-2004-x64

1

onnxruntime.dll

windows10-2004-x64

1

onnxruntime.dll

windows11-ltsc_2024-x64

1

onnxruntim...ed.dll

windows10-2004-x64

1

onnxruntim...ed.dll

windows11-ltsc_2024-x64

1

opencv_world4100.dll

windows10-2004-x64

1

opencv_world4100.dll

windows11-ltsc_2024-x64

1

settings.cfg

windows10-2004-x64

3

settings.cfg

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    R6 AI Release.zip
  • Size 62.1MB
  • Sample260702-b8mtpsay8w
  • SHA256 3f47bb811f6f13877eb78a5201dc82928547630472f0a34020a3c352b33ab022
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarepersistenceransomwarespyware

Malware Config

Targets

    • Target
      R6 AI Release.zip
    • Size 62.1MB
    • SHA256 3f47bb811f6f13877eb78a5201dc82928547630472f0a34020a3c352b33ab022
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2
    • Target
      DirectML.dll
    • Size 17.7MB
    • SHA256 9c9e6d822561c6c41b90e6994b3e8857cf1d66dbfb1e0c4c799c7c89b4e92da1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral3behavioral4
    • Target
      OverlayDLL.dll
    • Size 44KB
    • SHA256 f4ba796e7a679138603270554314426f0d1c48270c5d61ad09e14abe4954b83a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5behavioral6
    • Target
      Redock.exe
    • Size 99KB
    • SHA256 c4df14b989b9e9c43ad96e19c9dc34718c471ad3b4fb6e6f9cdbe5aadb443651
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      best_fp16.onnx
    • Size 42.6MB
    • SHA256 8fd2f45779d0303d4bb77f47ea7edc656ca452bf1d21a9c1cc14986e535750b8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    behavioral10behavioral9
    • Target
      kdmap.exe
    • Size 149KB
    • SHA256 3a34fadb016e1c71dbcf75f9b245f1049032d4d1841ef0a96f7971dcc3bf6e6b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    adwarepersistencespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral11behavioral12
    • Target
      mouse.sys
    • Size 12KB
    • SHA256 a417bd0afe7989fda45a2709956a9cba71d89bf5489967f8a46db8ab1756c137
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13
    • Target
      onnxruntime.dll
    • Size 16.5MB
    • SHA256 8fba9fd33466c722a077731d46947d009ae20756b18977bb13158a29dd93d80a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral14behavioral15
    • Target
      onnxruntime_providers_shared.dll
    • Size 21KB
    • SHA256 6a95b8e65633a00e90e9c6e7f2b034708b82a58de79357e4e81bf0a06ed21145
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral16behavioral17
    • Target
      opencv_world4100.dll
    • Size 61.7MB
    • SHA256 e6e31e55b9b377b775782c4b27a80b2460dffe3dbee7898e034d25729dca0198
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral18behavioral19
    • Target
      settings.cfg
    • Size 46B
    • SHA256 fdfedc03af1912eefb49cddbd102ea1fe3b6046472159daae7cdf6644734f22c
    • MD5 SHA1 SHA512
    Score
    8/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral20behavioral21

MITRE ATT&CK Enterprise v16

Tasks