2f446d6fa3866582175f1a22a7be198eeee0aec7aba5b4e04ad25c99eae2d265

Sharing

Copy URL Twitter E-mail

General

Target
wimlib-1.14.5-windows-x86_64-bin.zip
Size 760KB
Sample260703-apetbadx3l
SHA256 2f446d6fa3866582175f1a22a7be198eeee0aec7aba5b4e04ad25c99eae2d265
MD5 dcc85400b4f19969d397b605bca240c2
SHA1 796543d8fb1d20888d1bf3925ca439f8038a184c
SHA512 615131839c71678d3061d50a00184aabcb1100c9027e8b07816a269b63dc82f08229804748783100320fe7c973f15df9b1d6134322862b4fad0858e44469cbe8
SSDEEP 12288:4NRF9o3tUInjk3AMeyIk3AMviwKce7sKhs/zu7pY+d2W1qEJAosyMhPL64IZbMxt:4Nxo2IjwApPwANce3hs/zwpYNaAostPx
TLSH
T18EF4230D8069B2EEDEF4CAB250AC1561716F119F7BD87FE7224CD406EA91AF98C1305E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  doc/wimappend.pdf
- Size 58KB
- SHA256 a8e5ac1b19d83404d2a4da8a6b512c550d358d00e7769157eb3c59bb17269715
- MD5 436ff87353efcf0cf3087b05a576f68a
- SHA1 49cbf033e247894c2bebf566eb6ae41517dd32d3
- SHA512 ef3586ff7c0c32f886421a0ae5a75a40ec6948f20f484f0412a2b86ead99f6d3f31dc5177a08dcee253f6189b2b0ba068411625c4798e797682732f963df8da0
- SSDEEP 1536:kxnoK0X/HzLQgw38KOPRfgIdHcy/6znvv0pF/L9FJ8hc+a5zrQIMR:keLXQgwsKs1oy6zvvahxqezcf
- TLSH
  T1F443CF18D8A1B45CEC52CD4646BD792D062EB22771CC7881797E8F89A390CE8FB135E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral1 behavioral2
- Target
  doc/wimapply.pdf
- Size 46KB
- SHA256 d4c8b7b10eda25b7ce53604bc271e0fd53779b4484a5a6f67c5a3b0b90d854d8
- MD5 8779c162c27d05532b6bcdc67df5a2d6
- SHA1 28b0f9cede2e6eb9313a3444a971761ddea53cfb
- SHA512 49807c2c306339d4f0945c44acc074bac66470069b783a62fded06a928fffab5ff7ec54309b882b3de99be3a237a5552ce21a771adbec372cd163e44a986b3b6
- SSDEEP 768:zzbhTqqrPOMZc/L/+batmhqsjYdsU4PGdeXiDvGjNvIVLjMskh/FUvI6EmOPZ3/2:dTpOiiD+m9rsdILHOPtlX0
- TLSH
  T11223BF61C453A89CF8C0D967953D396D876DF33671C878D13C2C8E8A5384869EA53AE2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  doc/wimcapture.pdf
- Size 58KB
- SHA256 66f411a5bbe3e86460419c6ed7971b1c89aad6f544f3fe35cbc6225cd37601bf
- MD5 59e399807aacf9c4ee55f6ec739d489a
- SHA1 3f634f136184b5dad0c99f824fa97dadc8bbae4c
- SHA512 593b0fc13ac676535ed55d6779c8a4e192bf2905df890d767a226a3363314976ef82b8dd07ab33716ad678d3a56d967ce314a10a3861193d54ce9036c6d5dd4f
- SSDEEP 1536:kxnoK0X/HzLQgw38KOPRfgIdHcy/6znvv0pF/L9FJ8hc+a5zrQIMF:keLXQgwsKs1oy6zvvahxqezcb
- TLSH
  T17C43CF19D8A1B41CEC52CD4656BD782D062EB12771CC7881797E8F89A390CE8FB135E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  doc/wimdelete.pdf
- Size 21KB
- SHA256 1eaed7765fc7c4d7609a4099f324f6150e822b118aaa56dc2e579f5711ce1121
- MD5 ad0b6b89fc8eeb0b2e4016aa485d4f1e
- SHA1 bbd5aa165dfe62bd158d9870e8234af32b09414c
- SHA512 65f8c25154bb4f8c7d5f1a8abc80f74ec3aaa633e8da22391c4880b78d52ef668b8cee730af78a4c4f821dfccb70c3a9e11276a7b6db49b671645f5bde63ad42
- SSDEEP 384:zD3GVv43LOWD0jbCzxDKf6mQAdCutfPcr51RY2IUJfd1nmlDjh22RLkkUkYLFZuQ:zqO3iWojWl+6mQ4Cu5EY2Ikz0Djh22Rg
- TLSH
  T110A2AD01CD19A98CE402464754BCB96D436E737B7AC4B8D23D7C4E4A8798AD0FE372E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  doc/wimdir.pdf
- Size 19KB
- SHA256 2539ee64f4acbda66e834b5f464d96d2a579780886e413238b1448bdc87e0fa4
- MD5 85808336ebf9083b83d6efac5634a4be
- SHA1 54ec2e16844060a6df14e91132f22bd5196d8b96
- SHA512 716002c9e09ce53e16720a67127f57eaab3b57254e80ade14c8d80cde94c07ce33e249a03b48e7400069638efb7b40b58d644518082ec4d91f1bc64750c80987
- SSDEEP 384:zDtQJ+gT2LOHy/fhOdyOK/C5OKOY3hIDZW7I9b5tuNkkvQpOI/xNYwnr0kYLr8zT:zJc+gT2iH6fAdy5C5Ph2Q7IpZOQpRfYM
- TLSH
  T156927C40D905F48DFD41A40AD57DB60D079CB2B636C478C13CBE8EA36740A92DBB79D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  doc/wimexport.pdf
- Size 31KB
- SHA256 b4c960e545dac7ffa292a95d5d50d2854e5e10dfe4d8b0b945b6046b497f3d63
- MD5 ed2bc61ffafd6bb0f685ee4e9752a188
- SHA1 a6d8aac708c3e9ca3642c5f2e6ca8f49350205ab
- SHA512 981d292f635763d64f980ef39620651f4593474c0b8aebfae3fe45d1d024cc4e2a565f75c4c26b933f8b6ffe99cd00c4dd71964ae0713bdc77edb6da3930dd62
- SSDEEP 768:zmpSLgDBaVwPGdUOjMidhsJC09ZUvcg2tF82K/hKVFWspHmhrL0SXeb1zSkYGV:CVagXROEttw8Rpi0SXeb1zpV
- TLSH
  T174E2CF48E116A8CCFC966A07597E356D871EB73672C4E0E13C7E8D968380C6DDE07AD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  doc/wimextract.pdf
- Size 29KB
- SHA256 1fe2b550844dc2be6ba43d9ee88740c0ca9fc67f294d479316d577b77ac4ea14
- MD5 4565e3a3b1f320e328bb028f679b12a6
- SHA1 c46a5697b01b3bc97dfe6162ba87531c2d028620
- SHA512 05fd2429cb527accc5ecb1270fa91af7f6f0f791a0da555a0588901cfb1bf8f31ed4fc8dea3454ce9e2230975523bf785797ca9fe524c3e551e65f8b2fa8e868
- SSDEEP 768:z39p72bul/M3PGdUPjJsKn3CbriIoA5eqbEEBoxSHPd8ErD3FhCQ45xkYZy:Tq0UJVmriIT5ekuxSvd8e3Hn45Xy
- TLSH
  T11DD2B068CADDE84CDC828659567DB428472EB23B74C864E03C7D4F459780E42FF67AE2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  doc/wiminfo.pdf
- Size 21KB
- SHA256 b5fb862eac00dc29f886e324aed8ebc754da33404379bcb3ae6073f9adfd6ba3
- MD5 5b1e5fa44a4d69723579fd9483780365
- SHA1 9a13f30ae87228b5250516b6fb007ac1c9330ad8
- SHA512 e5a0d291047f525d731363d91886833638616f26ac81fe21652a40ba52c77e37f125ca0c99537556819ce3d3ff8f33031d2f69c734491d7c8ae125a0cf798c41
- SSDEEP 384:zDgwqJx3DwLONdjbOE16KfDVIQEpnXnifa4KKZGhxZQ7sDnJzkTFSX1gskYLAI0:zMw+zwinjKE1hDVIQsnifa4KKZGhU7sy
- TLSH
  T1B3A28E44DDA9A94CE802985359BD391AC72EF237B6C465E07C6CCE839700DA0DEB35C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  doc/wimjoin.pdf
- Size 20KB
- SHA256 e19a64ccde5b49741e3b68e4eab21d143c492e6287efa61853d1e582f92c1a94
- MD5 50590c2fb318d8526ca4685fc0a0ddad
- SHA1 ff601d12aaa3eaf8b31473839e5078adbee1ef84
- SHA512 b5429fc4898a9e108a27dff82ba071dffb9fbcb6ec036c06808df3fc54a96df716a62725aafe7ef3429ae4db309cd85712117fceb254683d844c4b30e5e97de3
- SSDEEP 384:zDAQsBKLOaXA08GOCRBg/1u7WQXIVYAc1fONl18KmgFk1Sdjr2q5+HWrFbSkvORB:zMzKia58JCRS87WQXEl18jO/v2sCWrle
- TLSH
  T1B0927C409905F58CE88295025AB8795D832DB3377BD564E23C7D8E82C781891EF6F6E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  doc/wimlib-imagex.pdf
- Size 34KB
- SHA256 2002a95e338fa548d398c10291074bdf4f11d447a3d92e495337d954a65f5d5f
- MD5 12187642303e4686a5497e2d35f54848
- SHA1 862191d59f6265ae18efc9e3b09a98c54319b229
- SHA512 1d60369f2d0bb57817cd58b3ec48ca5da4ac502bc95a9ddc9deb511a84e0704c805fa95499d2daf9c5eaa79c2ff8e3d58e4b891096a24610fecb8f9daff300f8
- SSDEEP 768:zsq+Ecc+nQzln7PGdeiZjV4eT4CwACQa9gk8xWLjlNqRsCPluOzfJzkYId:18c+nQzZJnFAW2EqsHOzyd
- TLSH
  T177F2B064E886D85CE99686075A7EB82D822CB773B9C470D13E6D8E818361C80DF775F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  doc/wimoptimize.pdf
- Size 27KB
- SHA256 e9b0232579b675ba92d400202f75a0b1f68ecff240551d2ec7cdef7467385aa0
- MD5 0464a5d05900e9f89120819d99f082dc
- SHA1 0df0aaafbac7c3e553c88809cceea1399683951e
- SHA512 81a33486d3806aa535c4c2e77755d63f981fcd26b9cf158a0ea46240a9e89f6b54c6bd48c09f8e72c6eecfd77dc215472b6ee12c6fe09c05e9ca07fc729c49a0
- SSDEEP 768:zSLxsyLVa5tuZpkPHej84PRf/9QIRCTZm27X8FBzdKwK/uX06HnsskYwq:UsypAtM+4PzA9m27UVdKiXRHsq
- TLSH
  T14FC2AE50EE49E94CF4C69A571ABAB419437CB327F6C56DA13DAC8E414340CA2EF274E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  doc/wimsplit.pdf
- Size 19KB
- SHA256 f88aa0d3b37636101dc2900841691909eae38a3850a75069272f22f37ecce21a
- MD5 b0ff20753aee74ca4ee7b240b9cb9c49
- SHA1 970d9fb2d9bf3bd41928903d97e35abdbd34fa4f
- SHA512 c1bc63defc5b31b1a8df91c374e94a8a4a0639e07a130f1ca433fd64a216ecf99a5a3b057f81209fa57415b2a765d5ec0e0c121b6caab7d989ef80c6abf4cbe4
- SSDEEP 384:zDo7Is1ePTLOaXA08GOUDDRK7Tu4YAWQXIVYAc1fONlgIMKmU4PjiGLj/ZDD7w6G:zMMs1ePTia58JWD0T7YAWQXElgIzmUUg
- TLSH
  T185929E60955AA48DE883994159B9380E4B3EB33B76C0ACD13D3D4D43D3818A1FF6B6E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  doc/wimupdate.pdf
- Size 37KB
- SHA256 72a434ab5a1cf481f721b85ca5842c23f0a1ed7b1a6bf0f71370284c6d6578f7
- MD5 d418dc7887d4d385aca21821e71d0a6d
- SHA1 5ffb2f1d4da87b7a8950b615603d0842af09dae5
- SHA512 03f624ddcf670e71e06360fa5c95b5226cddab3510f3eb75580c46fc089b40314cc1e744749c886c0e6fc8462ea51a22176c7aca37ce6730b298d964afef64c1
- SSDEEP 768:zcY7Zpi7iMLpIn7d1rrLj5iY7Zqt4xTnWrSUXTfKo3PR0jzE4kkYK/hZG:TnZvUNDG87KY0/u
- TLSH
  T1C103B040D915E89CE8D1990B8A7AB91D872CB337B5C5B8903CBC0E06D780E5ADB179F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  doc/wimverify.pdf
- Size 20KB
- SHA256 e01b7f179eb045e7bfa36fa426539efa17bca5198c667968bdb810afb4fea085
- MD5 823ca1178a9966622fc8c60fd100dd03
- SHA1 e1e2544717c38daae81e9c220c07babd1801c3d7
- SHA512 0cb2086bb9baf72d4691542115257f5a607abbcb93e3f99c0d857803956d22ee1aded4ff1fff17459b00ecc9892ed9c1d235e8a5ae345ee49bc862bb06438d76
- SSDEEP 384:zDxcmBBMjcLO5t0b1KOkemKDpm1QJGeRRgbOwzL9IJbIe+kjffFz1qn1GN5GWwl3:zdcmPMjcicbbkeJpm1QUTFzL9IZF+++N
- TLSH
  T1B9928E50DB0AE8CCE801AA4648BEB819873CF2B376C1A4F23CBC4E815745951EB676D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  libwim-15.dll
- Size 486KB
- SHA256 ba853ee1e3fc5f5798581f02e8e066ba07a0a2375f0bf444fe981431fd508495
- MD5 db1ef5ed32577db5433ce471ffb4b531
- SHA1 32baffa86cd54fe25d09ba937ee71094b55af7c8
- SHA512 99115190b1ed4cd32986ad1cb8778573b33d6b0d092d90a4ebd070ec0d123f4105bf66c07a389e2a0fcee1816f0fac1250c5f36030c9e3865c5f29b53482df13
- SSDEEP 6144:zC3LLufFLXCHlKyTgOSFuhLTmpkOLNw73ErtrZtkJGM2XbBz:zC3LafFLXdyUO9LT9gW7ErFZMGMa
- TLSH
  T103B43B02E3F311BCF2B7D6305A779A7269337C515830EE7E4198C6792E72E508A25B36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  wimappend.cmd
- Size 44B
- SHA256 ee409710298fcb804f6fe9531e8249381c610bbbf37bf23ce1971ad3530345ee
- MD5 b631b67dd85aca52b3bfab7ea4c75f93
- SHA1 6fbb3ea74d525210de490605469f5963d6ec9aee
- SHA512 41cfa269845f3db62fda4f7ac4878fdfb21fd8c91c240baa1cd408fa81b1f19e2564432f12a56a26cf9a21376e0a4cd918256d9796bd481afb73c5b83d26061a
- MD5 SHA1 SHA512
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32