5116cc1703384aac88b8d7a3b57f172aea5da32b6df7355fb2f8247d23813c8f

Sharing

Copy URL Twitter E-mail

General

Target
windhawk_setup.exe
Size 11.0MB
Sample260702-tht47set7n
SHA256 5116cc1703384aac88b8d7a3b57f172aea5da32b6df7355fb2f8247d23813c8f
MD5 a1a8fbcbde2d70638957f3e69a8e034b
SHA1 8185ffb95f72fc75f0fc4d964b2438b59a1fa653
SHA512 31ce367360058938998772e90b1caa9ce5733f67f4c13f3876a2710e15b14558c0ba01cd88cc5410fddcc1aa3780af0390c312e23545e00494c1ac6c39f28d60
SSDEEP 196608:xUDfxSCdVYdU5mqmm1o+79m8heSzXuF8hLzG5x6dHH+suqmIaS:xUFScYdUI5kZ9m8hN5c5x6dzuhS
TLSH
T106C6331233F1E653D6394E702218A7B79768AE71F644EE89A3C4904FC7005F27A4BE5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  windhawk_setup.exe
- Size 11.0MB
- SHA256 5116cc1703384aac88b8d7a3b57f172aea5da32b6df7355fb2f8247d23813c8f
- MD5 a1a8fbcbde2d70638957f3e69a8e034b
- SHA1 8185ffb95f72fc75f0fc4d964b2438b59a1fa653
- SHA512 31ce367360058938998772e90b1caa9ce5733f67f4c13f3876a2710e15b14558c0ba01cd88cc5410fddcc1aa3780af0390c312e23545e00494c1ac6c39f28d60
- SSDEEP 196608:xUDfxSCdVYdU5mqmm1o+79m8heSzXuF8hLzG5x6dHH+suqmIaS:xUFScYdUI5kZ9m8hN5c5x6dzuhS
- TLSH
  T106C6331233F1E653D6394E702218A7B79768AE71F644EE89A3C4904FC7005F27A4BE5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Drops file in System32 directory
behavioral1
- Target
  UI/resources/app/extensions/windhawk/dist/extension.js.map
- Size 848KB
- SHA256 812f06b603751ef44b48c60da723d60e5f042c6e6f051f867d1484b954661a82
- MD5 91b870c753052e30456fb3ba8f3ba1df
- SHA1 1fae1dd6c326f1c7e3f63cd4d85f497503738bdc
- SHA512 a23b6ff054c3a18fa986908dabe5da8d5652efcc0396052a2de35cbc90131993ca4462d7b8dd5adf4175f9f743433828995be05a2186dc8b2bf49b319fa08882
- SSDEEP 12288:BdWPoWtQq/lMpotQuBbrSRCdYlLB1WW18rXPRkFGZxP:BudYlLB1WW18rXPma
- TLSH
  T1D90508B62A7BF5390E1217FA6D9A4041B62BB84931205130B84C745CE3CDF69F2FAD76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral2
- Target
  UI/resources/app/extensions/windhawk/files/mod_template.wh.cpp
- Size 4KB
- SHA256 9bc5f34a36b0b403fc47f39c25025d5f5336fa2680d502491768e2f1945eb2a2
- MD5 92d26d05eebdf8fa51bc1f71cd0807bc
- SHA1 504e451a5e991d8bbace73867ffa78b89748a6bc
- SHA512 54c09c8fbb9effc1955957b2c0f06c0bc7d4775cd1fa2e23ae825b846cd21397805a7815183184984a2f5f501c2407491b2487cdc382bd342793a7d801835e1f
- SSDEEP 96:EgQ4tYAYb5VL0z/HGsJTLWFqeBtAytybXcEkfV9wMni:VPCWygbMEwwMi
- TLSH
  T16FA197AFA55653B40AB30E7DC64C830CE7773D9B2A028705749C82986F355FC92A2DDB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral3
- Target
  UI/resources/app/extensions/windhawk/package.json
- Size 15KB
- SHA256 fb9663b6cc3e46b85275453a31026ed4211c12d174c891066882475e33244a5d
- MD5 225dc86a246d1804921437130b9709dc
- SHA1 b4374623102fccad205f92aa16bc0bbdf068fa58
- SHA512 f2d8ff25d3df6c1c153582d1c9ee51c2c09f54461235afa8b73bd3454938cbb74ce963d5d5e8cbd1ee18398627ebe2b13c5d918771da6f0fa075fcf1e35318e8
- SSDEEP 96:k1hk0urQulrQfdXGdonTmpkDuV5mBEAe9MpkDWdon6h8+K59AnoEy5c79UNKxXsm:rHjCNXAN/mFV
- TLSH
  T19A72A6E7FFED047B4448048A90BCE0D2868FD7DEC2D61AF5702239BDA0AA1E5527B705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral4
- Target
  UI/resources/app/extensions/windhawk/package.nls.json
- Size 118B
- SHA256 c1d4d4ab5ad385c6c27039eacbf9a57b7763f69f8b5fa163787d1266f9a264b7
- MD5 e428d9a2dc2cb0d44541a515fb6220c9
- SHA1 b376e05cc93945a89061a33e5f467c5f7fae4bdb
- SHA512 03c25850b59efa2c11f8dd5985e74e013116447deed6c2d96d89c2ae132401b60106bf4a5bafe685df11828801c939efeff7e933ca190735192758b55218293d
- TLSH
  T19FB012EA4DFC0E1B01063EC44CF8217451A3079724420DCF9071BCF4D642F000C85031
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral5
- Target
  UI/resources/app/extensions/windhawk/prebuilds/win32-arm64/node.napi.node
- Size 913KB
- SHA256 78538a9e2ccf20de7d2edd39ea78ae4a01831d3a0502e92d0f90e30ec6b6a20d
- MD5 6d92041e57d4de4a942e55d13f36f42e
- SHA1 6c9c88879ce2daeadf6a3b818c475354086c4317
- SHA512 9a9c0e49f8f4a233635b1fcc53b0e78821dc7302540b07c13126ee2dff364748fa0384bb65c1ba6c9665fd3cc492f7a2da0c288387aa6e6cec456e28056194eb
- SSDEEP 12288:2+Lq+2Tfkk1RAkO8GedRIf51p1TvA/mwVIwTVpjzDx3W07Pl4iEMeExd1l:q3Wcl
- TLSH
  T15F1518D22B5E788BC6C3D679CC564B80301F66FD8432D48B3183126EEFDEAD595B520A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral6
- Target
  UI/resources/app/extensions/windhawk/syntaxes/cpp.injection.json
- Size 4KB
- SHA256 910b353d65859d7cfb51b67e2c64a93fe659529fe52575966796dc895b63f26b
- MD5 440a485789013ecdf4a83b970dc7ef73
- SHA1 46f694715845942d34fce02417948e105e45e546
- SHA512 08121f6b86294b727172f8501de311d89b2a8c0a63f4b648cf4b5dfe8951dfb74984ab335ea535e0e73676ce23cdce670e4b08658d27cfa7146d8724fe639848
- SSDEEP 48:AdfG6nwh7IvXYhYwy8G0IC2PFUBGo0YYmYwy8G+CS/xldGlsYksYwy8Gz/xlAmGe:NuwCw7yDXo/j7yDNS/4lsls7yDz/ie
- TLSH
  T1C68123BECC692C6705FA77B468BD8382F926023B0B458C0B797D058CAFB78475645F89
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7
- Target
  UI/resources/app/extensions/windhawk/webview/3rdpartylicenses.txt
- Size 169KB
- SHA256 d9f38ed6a479a7b573c81223dec20f5c4cf335a52213fea981d2f08b0e1537bb
- MD5 b56ba739c7fb4b8c48e4620f84b8d8c1
- SHA1 c5ac36c9fb727026d90521a28f17b25a5134ab9b
- SHA512 0d2cd39f8170aca80eaa559bf4cd4db0cfe2089c4cd500ccad7c309ff464c0ddd37a86fb1e563c3b82f363e32097e611bb51c4079f515ded2685db516a5fe415
- SSDEEP 1536:tLenVD28gIkOr4ArheKK21WQVerQNaBbcUtf8ALwhxCBePLciUBmyh6yhySDnhvL:zIQJrdcDy0yQ/GH
- TLSH
  T19A04951EB2600773189613705579ACC9F26BB25FBEAF2A88146EF345633B46CD5FB840
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

ransomware
behavioral8
- Target
  UI/resources/app/extensions/windhawk/webview/Oxanium-Medium.7098beb1dc0482713448.ttf
- Size 28KB
- SHA256 eb595ff7af9b8a563a670a57e15fbee6649285c9895da7e05acf0ee21c11e7b3
- MD5 a4129138f9d7ae92e41c3b8409c30da2
- SHA1 2c0470283b0632d00b32492d95a7bdf24d6e2e53
- SHA512 fa9d4b276f540b461a472d4eced7122fbd7c155ac981ae733624ff0f2893e95239e93fdce91fa44234d9273079b796de56df58cb582119b00ac9d3af517b379d
- SSDEEP 768:DhoA2GVJvIdesWLvVIsERbu/ZSjmx4EJjIbzijPw/H:9fbv7VIsE1JXH
- TLSH
  T1ADD22A16BB240311D8902F3152B6D3E9B7357CAAFF27C71B73C93EA27D261063925A05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral9
- Target
  UI/resources/app/extensions/windhawk/webview/codicon.4c354c82c52ca6cc2543.ttf
- Size 119KB
- SHA256 9d25513c861704be650eacef8c4588aceabdc8b668857747b5e42b299e926918
- MD5 08382d8b5f4698be7e944684d67b5700
- SHA1 5c13a3b68f007e04954230e04f5b509588c1dfe0
- SHA512 ce752bd7db24883ef8f2da61e87818406bfd67778df75a9579380bfd5e710dd3df71e8887904831230d10ebd4f2e2a7c31a4a35047e0b2fb04a0c82ee67f57d5
- SSDEEP 1536:GpjQ3QTW5BnOTOsAQFloB0C0DTp23Pq0PJ7hMG1G95DEN8z+yZX+At:GpjUgW5BOaC84BSlR1WoNk+ot
- TLSH
  T1D0C33A5EE38A8E3FC36382BE4DD8932221E0F69032D779439D6DB158C5825D49DE079E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10
- Target
  UI/resources/app/extensions/windhawk/webview/favicon.ico
- Size 42KB
- SHA256 ea45fb75f7d0ec4ba87bc2d76234c426c60fef511410b27e11d75ba66aecb4f7
- MD5 1a472ade23817848a2d4b2c9900d4a5a
- SHA1 312b05a9f58059bed85ee7896566476666fca433
- SHA512 8ab180f4475b2cecf4e13b23feb9d9580527e1afa67650de1a0c693c280e77c65d231a02335be0dc6ae6ae9204206e48bc2491a22a277cbf7331e870d9cbd844
- SSDEEP 192:flxYB+e0yJVE7ACTqQSIPGL5KGahF9fTVLlmEwD6bxSqRuV83ZGpGooU9+OAM:4cCK7ACOx0G2F9bVL86bA58Mpx+O5
- TLSH
  T12B13E6D203ECC442E19092F1A2962B770115CCD2BFA9EF8E26E631BD05B91C74B6E51F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11
- Target
  UI/resources/app/extensions/windhawk/webview/locales/DO_NOT_EDIT.txt
- Size 176B
- SHA256 46cf50bf090de247776fbf1c7ff10936a2e2b65e8127ea7854292068204d893a
- MD5 60fb4341f7453f2b539a34c7c676ffa5
- SHA1 4089f43f516294bdf40727c051629eb54e83e644
- SHA512 4e174bc700c4f2686f1f2ac8d5272992e73cce3a7dcb1e4420310be322ad5bb6d3fa4ea7a7d29302b6dfa0083a92c358ae975a79f43f41a57238115e43de37e9
- TLSH
  T1F4C0C0D0301045E3081023C07F40C3B9AE3B505CC36D044632050C0943124270FBFC31
- MD5 SHA1 SHA512 TLSH
Score

3^/10

ransomware
behavioral12
- Target
  UI/resources/app/extensions/windhawk/webview/locales/ar/DO_NOT_EDIT.txt
- Size 176B
- SHA256 46cf50bf090de247776fbf1c7ff10936a2e2b65e8127ea7854292068204d893a
- MD5 60fb4341f7453f2b539a34c7c676ffa5
- SHA1 4089f43f516294bdf40727c051629eb54e83e644
- SHA512 4e174bc700c4f2686f1f2ac8d5272992e73cce3a7dcb1e4420310be322ad5bb6d3fa4ea7a7d29302b6dfa0083a92c358ae975a79f43f41a57238115e43de37e9
- TLSH
  T1F4C0C0D0301045E3081023C07F40C3B9AE3B505CC36D044632050C0943124270FBFC31
- MD5 SHA1 SHA512 TLSH
Score

3^/10

ransomware
behavioral13
- Target
  UI/resources/app/extensions/windhawk/webview/locales/ar/translation.json
- Size 16KB
- SHA256 7bd6a69d62cfc86a911401c13e8d09e95b847277dbc6ae3074bf53944c1c19fd
- MD5 4a739413a0238c4df146965e596c47bd
- SHA1 a5f4135580f51f25aeba674cd871aad2f292e5e4
- SHA512 b7490b150f6258e1b5fd5dab8fb12ba9cef2353993c70199e593c793f9542402b0175c55f0c707a43f93bb64bf87684d0596160734a4d217cf14b028f84aee26
- SSDEEP 192:KIlf/oOjVjRv6YBQC6YBBcmLZ0y6Vpx32IAupLV+EUjILcWoE50oOHlPwmN0Kn2K:KoXpRjM7YN6EIrpo9m+DZn3U4n
- TLSH
  T182725C9289258CB206B59B0DD0E62668F8719F3B9246FC23387F160C5FB7C63D64A774
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral14
- Target
  UI/resources/app/extensions/windhawk/webview/locales/cs/DO_NOT_EDIT.txt
- Size 176B
- SHA256 46cf50bf090de247776fbf1c7ff10936a2e2b65e8127ea7854292068204d893a
- MD5 60fb4341f7453f2b539a34c7c676ffa5
- SHA1 4089f43f516294bdf40727c051629eb54e83e644
- SHA512 4e174bc700c4f2686f1f2ac8d5272992e73cce3a7dcb1e4420310be322ad5bb6d3fa4ea7a7d29302b6dfa0083a92c358ae975a79f43f41a57238115e43de37e9
- TLSH
  T1F4C0C0D0301045E3081023C07F40C3B9AE3B505CC36D044632050C0943124270FBFC31
- MD5 SHA1 SHA512 TLSH
Score

3^/10

ransomware
behavioral15
- Target
  UI/resources/app/extensions/windhawk/webview/locales/cs/translation.json
- Size 13KB
- SHA256 0b1695f70fb85f17af3e2e5a3c21ea30d04857fe093785f63f74cae7f462d359
- MD5 66f78a329b61d40b6b7c64ef4f3dcae6
- SHA1 b9e9cbe7c3e063882fb4128059b73ff198bfdfd1
- SHA512 bd5918f01a456b1439cbdb717c7900d36cde00f27766d52e6863c7c8fc5fe2e974395d911353338ffce3d4f88af7053b4dc8fcd455376b7b55f03480ddecda7f
- SSDEEP 384:1SaOwlBlDELwKlhCNkLxlhotkGEKqxQDknJujCBmOKN+t++2K:1SbwlBAxQDkP++2K
- TLSH
  T1A752502BC8A99C2B4AF55754287C1A83F52A033F1310481B7DBED24D0FF3CB758A1A66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral16
- Target
  UI/resources/app/extensions/windhawk/webview/locales/da/DO_NOT_EDIT.txt
- Size 176B
- SHA256 46cf50bf090de247776fbf1c7ff10936a2e2b65e8127ea7854292068204d893a
- MD5 60fb4341f7453f2b539a34c7c676ffa5
- SHA1 4089f43f516294bdf40727c051629eb54e83e644
- SHA512 4e174bc700c4f2686f1f2ac8d5272992e73cce3a7dcb1e4420310be322ad5bb6d3fa4ea7a7d29302b6dfa0083a92c358ae975a79f43f41a57238115e43de37e9
- TLSH
  T1F4C0C0D0301045E3081023C07F40C3B9AE3B505CC36D044632050C0943124270FBFC31
- MD5 SHA1 SHA512 TLSH
Score

3^/10

ransomware
behavioral17
- Target
  UI/resources/app/extensions/windhawk/webview/locales/da/translation.json
- Size 12KB
- SHA256 85ed976e3cd73f81cf51f65d4a2e9d1bc43cff3a29ca61d5b9a7cbf72f21ac4f
- MD5 7736e0d8495f562be552a0eafff87683
- SHA1 c8b865952591cd5f76c30c422966b5d3e69a8cce
- SHA512 d98f191b8cd9198198b84686d5ec60d3991e1b15fae56ea4ed2369fee03a872b6d0913d1d6f08d8670e32e65174bbe1c034e077e8d06ad1fa0ed60496d1f9d80
- SSDEEP 192:SAxPvllQZSI6byfsHbFfs5hUq4TnILBf+EvvsA7U75XC30D1FXyJkN:S4lQZSVWf4fXIBsA7CAql
- TLSH
  T1E3426283CD754D6F01F7036668624A4AF669236F5340090BB9FCD09C0FB387197ABA6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral18
- Target
  UI/resources/app/extensions/windhawk/webview/locales/de/DO_NOT_EDIT.txt
- Size 176B
- SHA256 46cf50bf090de247776fbf1c7ff10936a2e2b65e8127ea7854292068204d893a
- MD5 60fb4341f7453f2b539a34c7c676ffa5
- SHA1 4089f43f516294bdf40727c051629eb54e83e644
- SHA512 4e174bc700c4f2686f1f2ac8d5272992e73cce3a7dcb1e4420310be322ad5bb6d3fa4ea7a7d29302b6dfa0083a92c358ae975a79f43f41a57238115e43de37e9
- TLSH
  T1F4C0C0D0301045E3081023C07F40C3B9AE3B505CC36D044632050C0943124270FBFC31
- MD5 SHA1 SHA512 TLSH
Score

3^/10

ransomware
behavioral19
- Target
  UI/resources/app/extensions/windhawk/webview/locales/de/translation.json
- Size 14KB
- SHA256 4c2a5765574d667236e1d43e6576e108da5714b68141d40e1c1db23d73ed00bb
- MD5 c3d1dc539eab64d7c1a0ce782bf9a98c
- SHA1 bf5a92cd64aaae983d78a0cd96793bdada75a982
- SHA512 97cfd5aedf19ef0732df011fa23a0e2128861f64fad3b33a6dbf9c617557abc286870b1cc6a5b4ad2a413ac5353bfb8e65f3138ecea4b3be2983a36264b12d70
- SSDEEP 384:aApVY/4MLpAOw9LqHKgKbe13JokP9iuNoFon6koZy6r:TMLOOCLqqgKbe13qkP9iuNo+n6Vv
- TLSH
  T104628113CCA55C2B46F667A168958E97F625832F43402A1B34FCE19C4F738B292CFA75
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral20
- Target
  UI/resources/app/extensions/windhawk/webview/locales/el/DO_NOT_EDIT.txt
- Size 176B
- SHA256 46cf50bf090de247776fbf1c7ff10936a2e2b65e8127ea7854292068204d893a
- MD5 60fb4341f7453f2b539a34c7c676ffa5
- SHA1 4089f43f516294bdf40727c051629eb54e83e644
- SHA512 4e174bc700c4f2686f1f2ac8d5272992e73cce3a7dcb1e4420310be322ad5bb6d3fa4ea7a7d29302b6dfa0083a92c358ae975a79f43f41a57238115e43de37e9
- TLSH
  T1F4C0C0D0301045E3081023C07F40C3B9AE3B505CC36D044632050C0943124270FBFC31
- MD5 SHA1 SHA512 TLSH
Score

3^/10

ransomware
behavioral21
- Target
  UI/resources/app/extensions/windhawk/webview/locales/el/translation.json
- Size 21KB
- SHA256 d43c0cffac67ba866b6f53af735ba337d6bec59025bf0b282507894595d9f793
- MD5 22d0080efb451f6e0022816074e14a8a
- SHA1 ebdbf999520574645c06d0cc503bbc6e212ae6fa
- SHA512 ab9b612274e34241030b78d54cf3138d39b5398fb7713635380f905b97584d9089bc433a8e35e95c838af242411c3ce66078e7eedc71d74424b2b2898f9beb23
- SSDEEP 384:QuY3Wi0/TIeOtvYh4CmuAIHg6ZyCuH4lQEe/3jsRNiZn9hMM:QuY3Wi0/TTmghwkHg6ZyCuHb/mi1TMM
- TLSH
  T140A296DFF4B81DAE60A557064498A078B7421E2FB709CEDAB23CCA587FF90618511E1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral22
- Target
  UI/resources/app/extensions/windhawk/webview/locales/en/DO_NOT_EDIT.txt
- Size 176B
- SHA256 46cf50bf090de247776fbf1c7ff10936a2e2b65e8127ea7854292068204d893a
- MD5 60fb4341f7453f2b539a34c7c676ffa5
- SHA1 4089f43f516294bdf40727c051629eb54e83e644
- SHA512 4e174bc700c4f2686f1f2ac8d5272992e73cce3a7dcb1e4420310be322ad5bb6d3fa4ea7a7d29302b6dfa0083a92c358ae975a79f43f41a57238115e43de37e9
- TLSH
  T1F4C0C0D0301045E3081023C07F40C3B9AE3B505CC36D044632050C0943124270FBFC31
- MD5 SHA1 SHA512 TLSH
Score

3^/10

ransomware
behavioral23
- Target
  UI/resources/app/extensions/windhawk/webview/locales/en/translation.json
- Size 15KB
- SHA256 60d833d3da2a1e90437c00e27949be56c5441e9376d34bbf051dbb97a29cda61
- MD5 e28afbe5a78b703815bcc044b91730e5
- SHA1 84187f598a1feb9d56d4eaf7fd137da9eb6e7b74
- SHA512 74900bc29d2c882813abec705829879a83382113a068e8c34154e6bc910ffd12e3236a7c1f6c412d387fef824d64af6930163797f069d6e97dc84e21430f394d
- SSDEEP 384:ZJTkV5gXvWnCQnfusmuduCuQVqXzCuJCa8E+XihAhowJ8UCdYlhOICkNOroE:b6gXvWrnfc4/08XIG8UCahOICKOroE
- TLSH
  T116724227CA241D3B05F253966C694693FA75837F1340482B39BD904C0FB7875A2D6FA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral24
- Target
  UI/resources/app/extensions/windhawk/webview/locales/es/DO_NOT_EDIT.txt
- Size 176B
- SHA256 46cf50bf090de247776fbf1c7ff10936a2e2b65e8127ea7854292068204d893a
- MD5 60fb4341f7453f2b539a34c7c676ffa5
- SHA1 4089f43f516294bdf40727c051629eb54e83e644
- SHA512 4e174bc700c4f2686f1f2ac8d5272992e73cce3a7dcb1e4420310be322ad5bb6d3fa4ea7a7d29302b6dfa0083a92c358ae975a79f43f41a57238115e43de37e9
- TLSH
  T1F4C0C0D0301045E3081023C07F40C3B9AE3B505CC36D044632050C0943124270FBFC31
- MD5 SHA1 SHA512 TLSH
Score

3^/10

ransomware
behavioral25
- Target
  UI/resources/app/extensions/windhawk/webview/locales/es/translation.json
- Size 14KB
- SHA256 a0ba02bbaaf4521645183a4bd93a37064fe88670eada6a1444b32c8a6ce7965b
- MD5 f71826ac5ef3b688071096e17245a1a0
- SHA1 9e4aff48793af5c025949534d85f5cbe2d05d09b
- SHA512 5fb2225f3958d8d60d8a34caa31dc42acd634a872d0985a6df44c9557425d72d1aea6e03cef4779aaf6235be6c09c624f74ccb0a8adf733343da0eb1286043ba
- SSDEEP 192:jgq2zKlMuJWxKjNUHCwtZmxCgTnhd8BowMjMon3ib610nt+QK:jgqO+MuUxKjNUiFGBP3Cibux
- TLSH
  T149627322CDA41C1715F213993852C763F590437F3244C91B7ABD46AC1FB2EB9D09BEAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral26
- Target
  UI/resources/app/extensions/windhawk/webview/locales/fr/DO_NOT_EDIT.txt
- Size 176B
- SHA256 46cf50bf090de247776fbf1c7ff10936a2e2b65e8127ea7854292068204d893a
- MD5 60fb4341f7453f2b539a34c7c676ffa5
- SHA1 4089f43f516294bdf40727c051629eb54e83e644
- SHA512 4e174bc700c4f2686f1f2ac8d5272992e73cce3a7dcb1e4420310be322ad5bb6d3fa4ea7a7d29302b6dfa0083a92c358ae975a79f43f41a57238115e43de37e9
- TLSH
  T1F4C0C0D0301045E3081023C07F40C3B9AE3B505CC36D044632050C0943124270FBFC31
- MD5 SHA1 SHA512 TLSH
Score

3^/10

ransomware
behavioral27
- Target
  UI/resources/app/extensions/windhawk/webview/locales/fr/translation.json
- Size 13KB
- SHA256 bc2e2abc55e62081912214721c91691581349d8292a1307166af5c4b39c5d988
- MD5 6485f562b51f7731130c38fbeb665463
- SHA1 e6b055c469d43a7344a13b7255cd82d7db2920f9
- SHA512 26e69d12c7507fa9f48df027ae4a29dbed4c17e89f40589d861ca003e897d8c9d9b0e3f05085712dc3639a4b2f17d03763b02e0d37ebdf6512a8f5f3448fba4c
- SSDEEP 192:aABlk0BBFQqdp+9Lgdof0OV3a8rJoSg5TVH1u/1h0jh5:aWk07yWpK1MKa7S0JVeEP
- TLSH
  T17E52432BC9F41D6704F1136279128993F52543AF2340891B78BE968C0FB78F5E687AF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral28
- Target
  UI/resources/app/extensions/windhawk/webview/locales/hi/DO_NOT_EDIT.txt
- Size 176B
- SHA256 46cf50bf090de247776fbf1c7ff10936a2e2b65e8127ea7854292068204d893a
- MD5 60fb4341f7453f2b539a34c7c676ffa5
- SHA1 4089f43f516294bdf40727c051629eb54e83e644
- SHA512 4e174bc700c4f2686f1f2ac8d5272992e73cce3a7dcb1e4420310be322ad5bb6d3fa4ea7a7d29302b6dfa0083a92c358ae975a79f43f41a57238115e43de37e9
- TLSH
  T1F4C0C0D0301045E3081023C07F40C3B9AE3B505CC36D044632050C0943124270FBFC31
- MD5 SHA1 SHA512 TLSH
Score

3^/10

ransomware
behavioral29
- Target
  UI/resources/app/extensions/windhawk/webview/locales/hi/translation.json
- Size 24KB
- SHA256 9c8768290b924e3de760c3ac9061926db49763fd285d6adcd0c0f0f6dc4aab9b
- MD5 d23b7891921b09a463663c364ab2fb16
- SHA1 15649e398f0f07f2e0356d3f2d4933e05884901b
- SHA512 d1017ff29e1cdf6580c53fcd26e622300d5b37f99cb80112e4a8cb9570a148304ad45c0090bc0bd023b838c129fc1457de9156eafec214d118232cdc912eb6fc
- SSDEEP 384:FvJN32JVWQWcZIQWcc0b/rxlw3tpS69hhhmC4b9lJFrLKng2pcRpbD6:TNCNAYz2
- TLSH
  T186B2250DDBB9F76A4DFC3899765C0D37E5AC223B53A0421378A873CE4F60C74459A6A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral30
- Target
  UI/resources/app/extensions/windhawk/webview/locales/hr/DO_NOT_EDIT.txt
- Size 176B
- SHA256 46cf50bf090de247776fbf1c7ff10936a2e2b65e8127ea7854292068204d893a
- MD5 60fb4341f7453f2b539a34c7c676ffa5
- SHA1 4089f43f516294bdf40727c051629eb54e83e644
- SHA512 4e174bc700c4f2686f1f2ac8d5272992e73cce3a7dcb1e4420310be322ad5bb6d3fa4ea7a7d29302b6dfa0083a92c358ae975a79f43f41a57238115e43de37e9
- TLSH
  T1F4C0C0D0301045E3081023C07F40C3B9AE3B505CC36D044632050C0943124270FBFC31
- MD5 SHA1 SHA512 TLSH
Score

3^/10

ransomware
behavioral31
- Target
  UI/resources/app/extensions/windhawk/webview/locales/hr/translation.json
- Size 13KB
- SHA256 902116e08364df287b65ed2234035d5ad7c2d257aead4eb6b0cb9f6f254b35d1
- MD5 8c816e8426a82f4faf367ab87a2da914
- SHA1 199b50f60d95e49a846f0fafa0a52960932605ce
- SHA512 efab2852d88faa102280179e937d0e1c425a7b9ba1c38aecdf56d01def0fac222e3d40ec43a0ccab7e538cf23d264d73d599ad54b94b17581317c824efb64508
- SSDEEP 192:7uy80FtlABzGeML59Uk0W1thoPek9/17JYjEXCdi0T1JHC41Q:xnFfAcxL59qZFN7ajFB0
- TLSH
  T1A952846ACCA94D5B0AF51785A9E10742F56D0B1F63404C2738BD604D0FB3CBA31DAFAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtCreateUserProcessOtherParentProcess

Indicator Removal: Clear Windows Event Logs

Command and Scripting Interpreter: PowerShell

Network Share Discovery

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32