34a215e272740032134b86c124a79ee32b31325e7c20718b5741e5bc4290ea05

Sharing

Copy URL Twitter E-mail

General

Target
34a215e272740032134b86c124a79ee32b31325e7c20718b5741e5bc4290ea05
Size 11.6MB
Sample260702-hzfscsdw2t
SHA256 34a215e272740032134b86c124a79ee32b31325e7c20718b5741e5bc4290ea05
MD5 d4515a23506cebab68872f0fb58a70f9
SHA1 c5d65bf72f96580a8146c48e4b34f253e8627823
SHA512 9db9a0cc112a46238bbecda7925cd8b906b41ba06dbd4caf68123aa7fd6b36e72aa289d65a51b2f76fa686136fe548590dc45abd98af69e830cb4bf5cb061911
SSDEEP 196608:4Hfyz8OwsucKyR/VgHtal80ftmZq7zG+Zst/XaLqtPzP+TbtHDkIdTRFgEg/U:44esuD+gta1VYqe+GwLqlzGJngEF
TLSH
T137C633C7E3ECA081E813023FA6A35575BC3AEFF901A55A1E794093BA3CB5CD8E547641
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  34a215e272740032134b86c124a79ee32b31325e7c20718b5741e5bc4290ea05
- Size 11.6MB
- SHA256 34a215e272740032134b86c124a79ee32b31325e7c20718b5741e5bc4290ea05
- MD5 d4515a23506cebab68872f0fb58a70f9
- SHA1 c5d65bf72f96580a8146c48e4b34f253e8627823
- SHA512 9db9a0cc112a46238bbecda7925cd8b906b41ba06dbd4caf68123aa7fd6b36e72aa289d65a51b2f76fa686136fe548590dc45abd98af69e830cb4bf5cb061911
- SSDEEP 196608:4Hfyz8OwsucKyR/VgHtal80ftmZq7zG+Zst/XaLqtPzP+TbtHDkIdTRFgEg/U:44esuD+gta1VYqe+GwLqlzGJngEF
- TLSH
  T137C633C7E3ECA081E813023FA6A35575BC3AEFF901A55A1E794093BA3CB5CD8E547641
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/AdvSplash.dll
- Size 6KB
- SHA256 c8605c3d043ed6ab8a0ae5f825a9dda47f0e37974ccc0a667ac28643cece0ca5
- MD5 6f99f840937ab5918d544583ce73607d
- SHA1 1c247ad770de0bb3c44ce8cd8b578339b96f73bf
- SHA512 a77e020cce5837c6408cce617ccec5c28aa29fe104f4cd137c28ee99b9ddc3e304c55a996b5dbe6f82766529e120d047bf51c78a833c97bc3a4457b161475a46
- SSDEEP 96:xIMNGPn/nysQ/aW3XvyOJF5Z8mULuxDtJ1+wolpE:xIlPvyskXvyOZZ8TLUDtr+I
- TLSH
  T122C1D737B2D261F3D29B00B16805779343A598713762581C0EA3C9C9EEA3EB7EC54743
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
- MD5 cfc7c53e282b0a7c527e4ed091f17fcd
- SHA1 3f3fb2dfaa9a0576803c5fd693f5c4c288ae4f1e
- SHA512 367fc4024397381cfc5fa83b303d5eb78e97904821260589ce81a51c3cbe5d7f5dd0bf7fa07142bcb13a91bce2b523de21cbb1d940cb7fdfeca35c54c67694f6
- SSDEEP 192:EhGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTmT11929WtshLAzgSrX8:EhNt+4t7uJalUnGesY7Lt8nCy/Yosa
- TLSH
  T162624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E0638565806D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 4cf25411f28f639f72156c24b0f66ea42f5aee5973f6c137d901da6ae42d5b7e
- MD5 4b8a750993567ac9a350ba9768fabfa0
- SHA1 7ee7a8c313b292d62561b085c9d490c0f8065624
- SHA512 c2a06e352815a2f5340e8244cf2c5a4a5cd7e7848ea67e454ab207262cb33130008491e83d053c778bea97720f7387de737bf15355db3cd5477b94f3571107bb
- SSDEEP 48:S46+/TTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mkGofjLl:zxuPbO5tCZBVEAWyMEFv2CmqL
- TLSH
  T171C1A370B3D248B9D591413778AB33D36612AE746784500FDB6311AA3820AE7AD3EBC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 e0dc3112796dbaa37f25ab54b7fac2fbf791cbc6e36a84fc61c6423b84a3677b
- MD5 e6f30908abfc6f53b7c3c36daec4586d
- SHA1 a9ce4ceb9121c0f4375010438359f564f77506e3
- SHA512 0161f510d894d7a85c7cc160ef1cbb694cd30580ffe537f82096f4ce966cf3f6a9fec4929dd93ba2b133eb23a0230e53969792ad647c3b0f5f2e5517d9970a09
- TLSH
  T1A78173BB92E00CF3D0A44BB780A71CE362B5DD301752001F4A478AA92590B67EE7EB15
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  CNCMachine.dll
- Size 61KB
- SHA256 dce88858e12def70646370b66046ac5a5a87f5dd1aaf2aaf1962f76c84813b64
- MD5 03d8a26666a30dfb01925198bef98a10
- SHA1 8399b3c5c7f133d242ed9ee7ba911ab7e617428d
- SHA512 81e3f2268542caf329c691e43edf06fe68bec326ee5ccdd0c2cc6dfeddc3cc2065319c5810402b2940b5cc468cc97269db29aaa52dddc3a788fe763584c5a798
- SSDEEP 1536:Q/ZPwUge4XASChP3QGPULzG0xr4OfSX2:QVwFQVlPU20xr4OfSX2
- TLSH
  T11F536E22BF40C1B1F5CA02B2A779676A503DB5A24BD052C37B8A0DA95E745E32F74F43
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  CodeParsingDLL.dll
- Size 751KB
- SHA256 d15e761db8650b96fd940240d267653b5c034be6e024014a6b14a5d85ac1544d
- MD5 f46d43dae351eaf891a6c6101f591297
- SHA1 566be71b68a5720fd0e6d68a40e16fed1917dcc7
- SHA512 cabbc44bf4d75e3073060b22addad73366e7962b1f033d03681ba8a3b678b27c6c37d576fc3bfe8967b353f6793475d1040ac36be02d8f678d7452e2d019cc50
- SSDEEP 12288:xCRglze6V13IImwc0t/KNZ5yvR7q8qMVeAneGY8:xrze6VHc0tyNZ5yvRG8qMVeAPY8
- TLSH
  T162F46C01F7AA817BE59F22F0AAF9A35E4578FE75073482DB63888D2D19B09C21D71713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  D3DCompiler_43.dll
- Size 2.0MB
- SHA256 2f23182ec6f4889397ac4bf03d62536136c5bdba825c7d2c4ef08c827f3a8a1c
- MD5 1c9b45e87528b8bb8cfa884ea0099a85
- SHA1 98be17e1d324790a5b206e1ea1cc4e64fbe21240
- SHA512 b76d780810e8617b80331b4ad56e9c753652af2e55b66795f7a7d67d6afcec5ef00d120d9b2c64126309076d8169239a721ae8b34784b639b3a3e2bf50d6ee34
- SSDEEP 49152:DpX9JVeE9HP6Zpy9KyhMI50Du8LljslNsHSHFUq9OiapbbO5Akb:H3P9HP6Zpy9KyhMI50Du8LljslNsyHiS
- TLSH
  T1FBA59E11E705D0B2CCCB00B16A5DB7A6647C9F30432096C7B2947EA95D72AF35F3AB1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  Lathe.exe
- Size 373KB
- SHA256 0aaf68e08cc17268000b6ee7a262dc2f69014af36a881c2004c5e53a69dd78b4
- MD5 f9d585cb22c7bfb5644df94dc93881c9
- SHA1 15effc9caf3261f2c63d50f0eb5213cc8ab3eae8
- SHA512 1783e477f3ed85cbd9a0fae912b6bd8aa0e766ff03f53b5aa98869105d21421bd1a49452197ba44682123961ad795bc437411ca1f4002c7be3c42385d3cb1c5e
- SSDEEP 6144:sjqf4OXIUB6tlLVuXAfOfEL8rgMwf43U5BlHCQNGvAsaaIQ7pGjMdeu6IGsGOWN7:ShCB6tlLVU8tv
- TLSH
  T185845CD3FBA440D2DDA7113BD5D48E6A6838BE742B2402C7BB94BFBE14715D2543A20B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral19 behavioral20
- Target
  MaCore.dll
- Size 651KB
- SHA256 0cb5f91c5fa9e69a4687006e61bf97a7087e085b4bba95ec08b7d3f276d4c263
- MD5 cf1cc8ba3e14c85e47238c5800ca4d85
- SHA1 25fc60ed57ee72bb7e15e9763d3ec8454e706d9e
- SHA512 cd5d375bcfae2f4182ee04598cffb354cb2da7c3f9b6895fe575dcc961166d2e3c075b598000e06e940cc84634baef8d89076433bc9e776e84d73e7221de093c
- SSDEEP 12288:RQxPZGavwz8uMFX2vMZ1d1xLtV3ngUJY/ZTufUGo4ZHJmJDN7L5sLdjUMZIe44F:RQxPvW8uMF//d1xLtV3ngofUGo4dwOLj
- TLSH
  T1EAE47D11EB8680F9F98E06B4A53A3E7E962C665B133451C7FBC86D486F31AC26D71313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  Options.dll
- Size 122KB
- SHA256 e2b2a9425fe60516e93dbc53aefab46d1378881e7a8eb72d23f4bdb6f86d412b
- MD5 b2179f4a43c45f5b3cefef97611fac1f
- SHA1 edaf97d9192a43f68805ee58f8ef704910742f47
- SHA512 be2657fc89ca05cb2ac2af486bf40a43345eeecc2b7f59d3875f8878ec0a554d45a54a59e0fd428f72975473ffbec03bae850174f6fea7314d108dad8ae6cb5a
- SSDEEP 1536:eTehzmOLgDLa02nfycMqhqC6m4+jiQQPVRtBHruIYeQk6uIO6OCXZOfmxxDm92xk:hzF/0cfy/zC6m4LnPVbkZOf4xKoxMwB
- TLSH
  T1EDC30802B2895278F0EA34FE5EB9623AA22FEC752F1015CBB3C158EE2575CD25D31467
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  RenderUtility.dll
- Size 1.7MB
- SHA256 8116dccab8969b8b02cd786d811d0752590cc15dbba4761d58f597ef7c6fb068
- MD5 5eb969bbc0dd5f779c04bc1981395d14
- SHA1 aeffde9025d1ea2851743f10db0232e2167e7399
- SHA512 2d28e316162d1b8b650d0e286b2167f349cbb1c2f7ab589ed6e777cf7ac5e35c0b1c7a0757cb7e71220128a51e264ef72215cb4c75784a268fc9f9a6f0e858cd
- SSDEEP 49152:DpvWtqdWCHgojLbHw9z16vk3OuLQQk3IlWnDCj7NrFClXhqvQ3O:DwtZCAojLbHw9z16vk3JsQ0IlA67lFCd
- TLSH
  T154858E323A90C07AD57A32315609B379A3FDD5704A38C287B651EE3D7E745939A3832B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  UserManual_ch.html
- Size 91KB
- SHA256 91245f5058366dd0dc77f8f1e83a48ee7561230217a26643734354048330ef18
- MD5 410a9a34710e81d45fd9c0b5fd76005e
- SHA1 aa9843cdea3f1aff9992ae1b15bc605952280f8f
- SHA512 e1f2fd3e00aa69a18f23248bc810d6875e8a578566a85c1e15df11eff4c47f58d2f8c0d39ab23e1c2ac9dda2aff1866e0db6620ebecf8064eb9d6c20e9816917
- SSDEEP 1536:ebTMFGhgEVzY8Mr/2uUmf6zdsQY+65isMXBktw6l/IC/QRt7RGfK4usCVrZZNt6r:tvT
- TLSH
  T17393B810D7335412413A84E9B0591BCDB091F549D713FBA4E3BA7EAAFCC98AE39152EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral27 behavioral28
- Target
  UserManual_en.html
- Size 90KB
- SHA256 a95be3a7eb428bbaca387e464c6533d78c8366ac7058bcd2fc534752e82fe5d7
- MD5 603558963c7426e585053e9e8f85e58b
- SHA1 ef782a5eabde08846f6948888a1b0972d68b7920
- SHA512 1beea572259e5e6ff0a6d34cd8e9a11f2e5641e361232dd93ac202f3567791306474a44b99e7b4c09c9d9821b54e313303447dbc8d96d9e1cd91bcb21271b430
- SSDEEP 1536:SyTGbPldzVIZlu+XAjFQNLeaywPijlDb8fvu5Q60JO90gQAuPfB01TEOMNKgrikC:Q9N
- TLSH
  T12693DE00EB1616125176C4FAB05627D97090E948D743F6A4F1FA7A3EFCC986E3A253EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral29 behavioral30
- Target
  boost_system-vc100-mt-1_59.dll
- Size 15KB
- SHA256 4c528e23338eaeb937a292404f9c30d8e3cf28a8e5edfd7f0b08e4b8099a6e15
- MD5 c00a1ef22db1c1537d8e486a24492ecc
- SHA1 a57e420376ccb9eac7ac150a5fea275ecbfcecac
- SHA512 aa09d99fd2f28b49be90118e7679cd2a17f8ef390538f80fd6a64d431958a3bf4b80a6f7712ae6c68be975cfe4a0c3fa422d911be6c5c93776c3f05eb411b63b
- SSDEEP 384:fEf2h+1dOAYuf/LQwi+nHInMq+DObDPV5A/J:fE2hKLxnLN7HN/ObDdK/J
- TLSH
  T14262E8524B16C1B0DE8D20711819AB29556D3BF95BC5CDD39AA21E0FECEA0C0F93DD1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Checks installed software on the system

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Checks installed software on the system

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32