8df394f6a562a8361b62673e25f63e7097370b9c63c5d141540119005aef9ff8

Sharing

Copy URL Twitter E-mail

General

Target
topaz_video_1.4.1.zip
Size 198.3MB
Sample260702-tqa2asew2k
SHA256 8df394f6a562a8361b62673e25f63e7097370b9c63c5d141540119005aef9ff8
MD5 70b168fc4c08bdca70e5a4fc662cd79c
SHA1 1ec2e316cdfa573c9db724b7913144c88796061e
SHA512 6862a270a21fc9319b926cc6fe7a7e5805e885275b8f65682f6fcac220fa19b4fe1572a7ef863e224860ce1466ac9b94e1f2ed036b1ac2209940a7dc3d12b8ba
SSDEEP 6291456:6+hLVGS1ukNz9AMAMFVEsaGrqRPD2rXedk:6EX13FFVBB6PDoeW
TLSH
T152A833858D2CDE19D91E60F7983AB704C4D2315B7BF2A359EF0C6C422539B7CAC25EA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  topaz_video_1.4.1.zip
- Size 198.3MB
- SHA256 8df394f6a562a8361b62673e25f63e7097370b9c63c5d141540119005aef9ff8
- MD5 70b168fc4c08bdca70e5a4fc662cd79c
- SHA1 1ec2e316cdfa573c9db724b7913144c88796061e
- SHA512 6862a270a21fc9319b926cc6fe7a7e5805e885275b8f65682f6fcac220fa19b4fe1572a7ef863e224860ce1466ac9b94e1f2ed036b1ac2209940a7dc3d12b8ba
- SSDEEP 6291456:6+hLVGS1ukNz9AMAMFVEsaGrqRPD2rXedk:6EX13FFVBB6PDoeW
- TLSH
  T152A833858D2CDE19D91E60F7983AB704C4D2315B7BF2A359EF0C6C422539B7CAC25EA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Topaz Video 1.4.1.exe
- Size 198.3MB
- SHA256 2e64cd510d4fc91add46b40bdbc2916a5e7ca640b2a93329bc64e98c5da88277
- MD5 aadf9f6478b7aa6e56f9fc68c59f9d7c
- SHA1 2ff4f52c89b36a2f188cb49866e6406cd954dc24
- SHA512 8cebba9858d1b0821d51e99651df6b06ba3085504310469c42f50a6cc7237bf8af612da6a47b2f9e23f9a47ab97e285bc02801e603b5609a16453957075d3c48
- SSDEEP 3145728:nGisjvDF4jrt00qabXtlTWgPU6AffgT9H+HqqlHSPvSy9fA8p1pdAhyxvad35:nGNDF4jB8abdlyEV+/yH3rpdTxvad35
- TLSH
  T177A833828C2CDA67E22DA4F7843AB704D4D2795B6EF1934A5F0C6C431939B789C24FE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery installer adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  _About.txt
- Size 2KB
- SHA256 5a7b15f43785196b78da393bc48d6c566297c4490ccaf6b48dfc38423edd7956
- MD5 a79a9083a0ba728c919f9cfe618ed017
- SHA1 b121232888f1e7f0c1ac64a7e268c412a14548e1
- SHA512 0d81a9f8ebd0dd98e3e85f57f936091f8e0120b4caeb9839def03eced408ac07391ce5e7ac6ee1213b194de10dd66e9b074e8019ed1b19659f5088a12c2c9d00
- TLSH
  T10741236005C61DBF65117207CE1D6AC8FF5924FE37B6532D35A03A2A21FE824863D9DD
- MD5 SHA1 SHA512 TLSH
Score

8^/10

ransomware adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  _Readme.txt
- Size 2KB
- SHA256 82f4ea59fbcd5309eba8ce9893ee5243134dd22939c84902ca08d6aa8aa45fa9
- MD5 b62006957bb105bfd1ef744bd264ae93
- SHA1 d3f217508ef88559afa1501425a4899744a742fc
- SHA512 fd8ebf004a797935a8bc057b277ce363047ba69f8bebeaff4976ae8f03fe2ba8ad66c0b65ba422a4f03a8de0fd88e26ef992eac86461da6b43f2a2bf1ad3f10d
- TLSH
  T17D514F47C36E6C6D4140B00BE90DBECAFA6B15BD7B7983127028387E33ED479862811D
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral7 behavioral8
- Target
  _Silent Install.cmd
- Size 1KB
- SHA256 3d3b33f48f95872c83d886a0150116516fbff4bcb55c07b52c6f198a512403f0
- MD5 ba4d129fbed3f8785ed3e2398265a719
- SHA1 3ea6781ff6acf6813064614c61ca999509794b10
- SHA512 63e0bc2be83c128192fd310c8a7159236c52c9c6b48a7cb379498c1e2b7b11da69ff778f55087232b20d61df269086bd326884836c604ca86f04c8daa8bb0de5
- TLSH
  T12D115A373670E54C93B40FC42D748522742122DB2DB20D50B4BF403B83A06C8386DF9B
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery installer
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral10 behavioral9
- Target
  _Unpack Portable.cmd
- Size 1KB
- SHA256 9ddab87e2201728a6f7dffde380c358524f54c778199bcc2c9c0d171edadddac
- MD5 e895fa370305be60a6b9b507038f82b4
- SHA1 18a6622ee3c915e60199f09639b6f3b950fe0588
- SHA512 bf44156fcb47b23dc9b6139902cc3f1b567e4e77eb593fd1c52e23c9d440f07e41e3b85f0a4fe62f8cc730860bef55af889334e6a869bd885a138ea5e5e7a7c9
- TLSH
  T170115A273670E54C93B40FC42D748522B47122DB2CB20D50B0BF403B83A16C9386DB9F
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery installer
- Executes dropped EXE
- Loads dropped DLL
behavioral11 behavioral12
- Target
  Описание.txt
- Size 4KB
- SHA256 660312a6df3978d973bf5ffbdd0d3e672f04a9418ab519e92d3baa73891baf99
- MD5 6e1a61370c1ba0e21aa556bba93f35e0
- SHA1 225586f2381aafbb38acfd87068c875b740eafd0
- SHA512 8e210d129be08f8b5183c731241f48ffccfd0edff1b7655ffe565c83935da0006a411fa07d6d76cdd72cb647b9d80bf8e12edcc400596dae5034c6239926c987
- SSDEEP 48:HAkdrEI7H1r8jnWKUenx+rDQ/+0z5FsG+Zfgbi6q+AzeSXu6YOd1/a8vLBjMSndd:VWWIYD4vsGDieAzDT1ZvGQNgDs+K9
- TLSH
  T1438128B056AA24AB1111F44BD9047E0DB8AB40FF3F9E572739D83C7A37F20648579A19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14