208ace37e4485798f1028b5bd278154b481b1aff7c9672cb1404a9571363ab2e

Sharing

Copy URL Twitter E-mail

General

Target
208ace37e4485798f1028b5bd278154b481b1aff7c9672cb1404a9571363ab2e
Size 532KB
Sample260702-nvtrbag191
SHA256 208ace37e4485798f1028b5bd278154b481b1aff7c9672cb1404a9571363ab2e
MD5 98d25acd98e1b610b80ce674e23829ba
SHA1 372c75f04e08f13f147600390a988ffb6d17da80
SHA512 16c2fe37d9b653cd1e6b9261d7688c3538ab994bb027dcb584405a6640f37cb613fae34ffbb7f51ea9d329eddcae0c7fa38bce2f6668a142e9f7ff0eb355837e
SSDEEP 12288:xPEdCNCPj0/xTpLS5/X+379iPyLWYeLhx0qz0n96nwujlJTMk:aCQPaxT5gX+LvLMljz0nOfjTTMk
TLSH
T1D0C423345A7BD1A0F147D43B1477CA32CDA61AE1CE47263D647E888183D38AE218F97B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  MAS/All-In-One-Version-KL/MAS_AIO.cmd
- Size 744KB
- SHA256 d94b1abcba24d26c5fbe114a15b53a558684d74a1accff79bbb2407be7102a89
- MD5 8451ca15ac617194fafd41cd3a40c555
- SHA1 b86153c46b0bf48de7b45877796a57ba0f419faa
- SHA512 4ef1a1a44ebc25875d58b36fa5ced11973682a2e29aa90e5d73401a126d2a1acabdaf8afa17f1abd5d364f171f5f86b554d9eeb8bde6346f07ee3d354834353d
- SSDEEP 6144:J3IHfNkf5g3BcEvTGmaiE8THncQx4Oa0ykj7AuS:J3IHCEcEvTGXiEmcAXa0ykj7U
- TLSH
  T158F41A466D0251A601B3F379DE53814EFB2AC2638375526879ADC044BF3A309A2FEF5D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  MAS/Separate-Files-Version/Activators/HWID_Activation.cmd
- Size 81KB
- SHA256 d26c015cd129f5b1a84abe9b846a0eeb7ed20f2a03e38129e46efcb526b6f298
- MD5 7aaf569550c8d0e767da30e007c52033
- SHA1 67c2ecce036f9cf914719bccdc7ae5d06cdc6f77
- SHA512 ff0468f8a961feb85298a34f7f2cc3fad326e2d94010d84a70aa810b161412effb2009dfc1c72a68115d28f8237bd25742db013d5c52c61362c619aa3346388d
- SSDEEP 1536:jD/Da/u3y/DaKPPQVhEE6Zt/flC2nq7Df+lirvGHIxGrS2ciUf6s:jD/+/X/P/g3m3HIpL
- TLSH
  T10C832B07B50260A602B333B86E675686E31EC6A39371A35C796DC088774A74DF1FB79C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral3 behavioral4
- Target
  MAS/Separate-Files-Version/Activators/Ohook_Activation_AIO.cmd
- Size 164KB
- SHA256 048402b1a27af2b08da22c800595502f019ba297a48e157ec0b987608191f59f
- MD5 7ce4bf0a57da78880586f2b2ca4241e1
- SHA1 cf6f2167505d20f1aed056def4323b6897085df8
- SHA512 e6b37d443099b9aed26b91b56ccaf4b24adad7566cb644bab4b15b1b04ee7f0fd54167b7eaefc29069584e7a4de4a1e96edd63e65dd01e9ec7147b03a08e4c79
- SSDEEP 3072:Rk/j/0ZU/QN5Gfew3HIpZv2xcG1MZgnnwT:RfNO3ICT5Q
- TLSH
  T105F32A476E42A1F602B3F379AA57958EE32DC693C330A29D396ED094774630670FE24D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral5 behavioral6
- Target
  MAS/Separate-Files-Version/Activators/Online_KMS_Activation.cmd
- Size 172KB
- SHA256 d60586cb7ee632117205d1735a90bb7116f6b7c649541754c8aa27251370df3e
- MD5 62dd3ff0aa686180844e6ee204c56907
- SHA1 53c5437f5039362f17d33abdbbefcbea445d16d7
- SHA512 c3293d3131aea6dc8722ac12799525d3bb9efcadd16cc49c9b33763d4b8d286c9864f587ae4b5c7b243872b5ac9061f1dfddc39d25d3a2f87e7c949dc4b83ec6
- SSDEEP 3072:mJe/j/q/Y/FmUGgDM20e3HIpvGGjYcnck:mmmW3ILnck
- TLSH
  T15B044A47A54260E602F323BDAA569187F72EC2A34331E2AC356EC484BB5631B71F775C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral7 behavioral8
- Target
  MAS/Separate-Files-Version/Activators/TSforge_Activation.cmd
- Size 359KB
- SHA256 67ef13f25ca36b5f366bc43c5b219cd69d90967e5c9e34182e3accf1d142fc76
- MD5 37ff5581828b14a6f39c2e876c9adbfd
- SHA1 7c1b3513ff9bf791d4f6db1965a9256f1a07c573
- SHA512 cd8b2b4bd9c85177b293cc01dbad15354ca2753bb9e49489a90c57d83e2670ec85e627b197208939680f332de349ca3ef98f76a0eb56cfc93923dfcda2408515
- SSDEEP 3072:vz/b/5/x/x/52env0yf3/nNq/Q/8/O/3/UGs3m3HIpJZl0FcExVTGX2THiwPr8ri:FF/J3I2cEvTGmaiE0
- TLSH
  T149741945A913A5A705B33379DF42804AFB27C33303755369BAADC104AF7A309A2B5F6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  MAS/Separate-Files-Version/Change_Office_Edition.cmd
- Size 56KB
- SHA256 d4b0229ea3a7fdb124962ed4bd0516aa9f019fe38dfd6d5d4217087bc55d5d4a
- MD5 ff31b0e6055d2e621e3c4b55d5c01ddc
- SHA1 7f1d144411a564972766f371e166ce32c07466a1
- SHA512 f52a184b304795eed80e2c83c4416c3374babb025d80e259ad4e1600ca0ee5a914237bbe73d95e0a680910a40315c8cd5b2e334af32c0ad2eae8dee0a16791d4
- SSDEEP 1536:A1/Da/O2y/t/k/g/I7p/S/LuXr7/N/0/D225:A1/+/k/t/k/g/I7p/S/LuXr7/N/0/D75
- TLSH
  T14943F857B94360A602A732B9D5A7914EF76DC2A3C32197DC386EC088B716354B0FDB6C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  MAS/Separate-Files-Version/Change_Windows_Edition.cmd
- Size 48KB
- SHA256 b15844902198d6ed5dd26b29043b2a131582dac9afa0fc14034491fd71bf00dc
- MD5 c9564c66946269e6d4277a407e27a40a
- SHA1 137e4729174dbd26fd21046a22c52610f2304b7e
- SHA512 6a07b2d9e713220f303e4d7d391021fb84c7c14a3f2f838f8a14c248a03a2ca02aabb6c266606394b6014be377713a6119d4e4e6911522df759e10f534acf25e
- SSDEEP 1536:4y/Da/fp21d1/BX/rA/cz0ykWk2a+Rnu341/H:4y/+/8d1/BX/rA/cz0ykHO5hH
- TLSH
  T1BE233C87750251A402F33275A56B828AF72EC1F3A720974C795DC0A4776B355F0BBEAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral13 behavioral14
- Target
  MAS/Separate-Files-Version/Check_Activation_Status.cmd
- Size 47KB
- SHA256 c9a1688c7ac1409483e279c418f7b8b12d2cc7b232c65b38f0656e2cd741b4db
- MD5 27a52fac266ce18ba89ec46fb811a5b3
- SHA1 81bdc69384058a3245629295d934ecf8f5821a80
- SHA512 0f36930728aa4e8a4c6af412f2fd7ef6caeb993098ac160efb75796cb8ea2405d554c6f71e2d567a01d803aaedf5549c57feda7f9de7a780f7faeb7223744edd
- SSDEEP 384:TM51DLGNV1caT1UwZoio081ReKVwlfaNodso0XTf9rcKbVKQKUKypLw8wcH3L+rg:TMO1c2o9eyPvpnga+BnJbYTf4Jxm
- TLSH
  T11923D905FD1B926B57C733926E72C68D6C7482EB06FE54A878CCC884F124F6893F9589
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  MAS/Separate-Files-Version/Extract_OEM_Folder.cmd
- Size 24KB
- SHA256 8149efb071552f848ff87429118e9ad0bb9ff7ce0aa4bb428a83fad852e6d539
- MD5 84a79cc9a3d8fe4fc15e5c4c38dfec9b
- SHA1 ccb04c232de8465796ebed6c916d57836bd73410
- SHA512 3954402b5b210a75d0a57ed7808fc655343e61b6ae08594d0f6a6375868572713a119268957ce030f0a8754b3aa00e419364f1beb26395d7f6f0a600ae12776d
- SSDEEP 384:cbJk0Z3PBFwnJcT/BFLGIk0SCHx3kbbxtUYgv1cwY:cJZfBFwnJcT/BFrk6zv1cwY
- TLSH
  T1AAB295D72906A06281B737BB4A37914EF72DC1A3D310FACDB49D4478B31A38DD4A91AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  MAS/Separate-Files-Version/Troubleshoot.cmd
- Size 58KB
- SHA256 a09a38473df2583c9fafc0bf17b8ed5ba98eafafb24d0316b97f7f8a9f7469ff
- MD5 b5ca3be590257bfbb68da669d3aa76b5
- SHA1 a769c27c0b1b575c549624e4687dc94f95cc0363
- SHA512 9b5e6cc9873bcc0b721c19d9e55e5dec01eb415d8879793a350c8da80579399c0dbf418410e0846932477b77dc5a8ced7be3ed0a8d72e128526e4a3d3afa2529
- SSDEEP 768:cJriBFcnNI/rBFXk6MOgXL9DlVhIQ++iW3AaPhPa01SAuXmPGnI1jzsWpjE50tnf:Au/ca/bMOgbHkQHiW3AC/te0v2G
- TLSH
  T13343E813B60190B182F233B9DE37964EB71EC157D324AA8C759EC158775538AE0BA3EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral19 behavioral20
- Target
  MAS/Separate-Files-Version/_ReadMe.html
- Size 84B
- SHA256 8932bacd828c0716b136af6aa15011aed0015e7838006f2cff7a64954a5696b0
- MD5 574e18c1f9b32a47f988ac91588901ba
- SHA1 4c0827e3deeb84cf442e0356dfc1883bcb131fbb
- SHA512 4c480c530af4218e5ac276228a372fcd799912eb183685f805b6c47b5d6971be42a4dca2baa016425dc2499367624cb70de12d280ddcb7b613001460dbf820f8
- TLSH
  T1CCA012D296101C07533225B06CDE200641134C0179445020C1C0389B04B4F04CC83331
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22