16f8b80e62869225a0a34988e98128e09f5546c9cba5c6fe48e880a994afd61f

Sharing

Copy URL Twitter E-mail

General

Target
WIN - Lateral.rar
Size 214.1MB
Sample260703-cvrfeaas31
SHA256 16f8b80e62869225a0a34988e98128e09f5546c9cba5c6fe48e880a994afd61f
MD5 02ea9594257fce55eefc4705259d4b7f
SHA1 0c4d17107eee780c35a944ba8e22b4c8dfd46109
SHA512 51fed13738c4ba35f346bd6c8d0ab3dcc06b65d578e68385741073b282f2fc0750e03b0cdb3ee506a35b18603527019da017695c3629b795fa3cd3805f140d83
SSDEEP 6291456:chUHrWRXXQh1DNjdVg2u8Gz0BypFcJ2HwS1wz8JMk7kN:chGrMXXQR3uFmn2QSwzc7kN
TLSH
T1B2B8338E64AEC69BF9893733F8294A87F0CA070FA734CADD2070C6FED8579745195A44
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Lateral full release/Lateral.exe
- Size 2.0MB
- SHA256 b2fe0f8cd0adb1d221d662e5f33b36b8245413178d8986b0d6dd3c42fc6d78de
- MD5 f760c2f862cf7d98b570bae41364e05d
- SHA1 e318735c83ca25fd4e7509eddb6fc0f2df90fc2c
- SHA512 6e759cd0b0f038e1c1158d5b58dcb5cc5c90e3ef85124010b55ec5744bc66b0cc74441ccb552402882af5d5f3ba4684c5e33d70889e0d2a930b3e0438c95a65d
- SSDEEP 49152:uMKeLJ95d90stngnOIoYcGfXZRcu+CsT1mTvj:G+sSuJj
- TLSH
  T14DA56A07A65504EAD199C078CF06D135EB71BC494BF5A5EF3190ABDA2E37AE03B39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  Lateral full release/credits.html
- Size 4.5MB
- SHA256 d9729b75ddaac7b9b21c62ccfbfbd12edb0619ab04da3d0cfaf1ff31e77dfc41
- MD5 9831b9e75e0208ce0dacb6db23d4acbf
- SHA1 065886a77a6eafac21c5c297bfbd4d2cb50751b5
- SHA512 27d57e91c41fd4cc000622daa7a404f9ff40c95589f5ced7d7beaf5336b4480ef1ffe972928794c76fabdc923b787bd6673191e1c5a1815d74b9438695637e99
- SSDEEP 24576:8wEBqmnLiLIi2hrErjKvMPkUoVAwurQBzun:VcqmLAstCuUcBq
- TLSH
  T17126D56BBB49037306F282626B4AA4CAF31E903F375A1514346CD15C2B7B92583FF69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral3 behavioral4
- Target
  Lateral full release/d3dcompiler_47.dll
- Size 4.3MB
- SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
- MD5 7641e39b7da4077084d2afe7c31032e0
- SHA1 2256644f69435ff2fee76deb04d918083960d1eb
- SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
- SSDEEP 49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
- TLSH
  T16F267D5677A840A9C27BC178CA574313EBB1781403349BEF55A0C665EF33BD26E3A728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Lateral full release/ffmpeg.dll
- Size 1.7MB
- SHA256 44917512b58d193b4361f2d07b723346feb7bc69f2b0ff51002b3c76f88d0f71
- MD5 f2db31ad12fd16c5359ac583181fbfdf
- SHA1 4721511f6b0294713032d3c3be82e638f1084e06
- SHA512 17ea72069aa2a601e4e5e2ae433d529796f153dbf1cd2d2443cd2b514ee7bdc73af36ba1fce2f54b74f2e4a4148a2e51dc2bae7b8b9fa4013fd3a9392497437a
- SSDEEP 49152:4pvlwTaS4rzi865zldVJQSJt9eJACdcVEhM:rTaSczQ/VJ9enf
- TLSH
  T1D585AE07F2A505EDC06AC134879B962AFB3178494B246AFF17D0B2293E77BD05B3A714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  Lateral full release/index.html
- Size 636B
- SHA256 52dbc1e78d34dbb53b2d693fa2b2cf6f42028e258dbceb75aac23f95f6893400
- MD5 134f33180b0659230efd43400f55456b
- SHA1 b87760f10cce97fc0771e206ab3dcf36b1000e23
- SHA512 290adb5a2faa86ad2bdacc3696ba9212d6dbb38b30cc59dc916649a0043c906e515d717db4c75f035fde7e8f790b940ba8c15272a53ca009139e96dbfc0eb9c5
- TLSH
  T160F0264648F2AC0932104558DDD1F8148C99415BD6909DC4F1DD107A8FE8FF904C39FD
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral8 behavioral9
- Target
  Lateral full release/js/libs/effekseer.min.js
- Size 189KB
- SHA256 49d8f79328495bfd9f47fce8378aa7d898adfb4238c36abc5801c78586d11dc9
- MD5 02f74608f9d6dbc0cb9ef88570da2eed
- SHA1 ce845dbb6fea3f369b06eaf64726b4f291ab1bdb
- SHA512 7d8ecb790f2ef58ad1362602bfcbb0e327a8932e89f605fcba5af5502bf3524c6bdfc255d89b08f7cf1f5a485e3107439f4b0e4eea53f57d4fb7aad9feb170d2
- SSDEEP 3072:xKz+yOG2j0AGx5mc2+kSPGJBOWLW9rjKJcUiJqzy:oOzj0AGx5mjS+zC9qiR
- TLSH
  T150143B88BB49E066C593B7BB943F060B39B49452A80CD05C90ADD4C48BF4F9AD5DBF8D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral11
- Target
  Lateral full release/js/libs/localforage.min.js
- Size 28KB
- SHA256 1ff66c1e32922549d0c824076703e69fb5535857934c8faa8023f51a4881f732
- MD5 6de1bf1f7f98328eba5295e0e8a00110
- SHA1 c071378e565cc4e2c6c34fca6f3a74f32c3d96cb
- SHA512 1bbd953f0e16d7838901f1a9f26b04ad1eab64918f63bc326ef3bb594aa83335e28bc5f126dd7df7bda879d57b21a7383284eef264aa391db7f2c36001e88522
- SSDEEP 384:lj5dGPModTXTO+ALOz46ELy9kPuMZb/C5eTppmcfAqoSXKjPxy2FADXtxw4ZuQB:BOPMoM+ALOV9kPuMZb/C5eT92i04Z
- TLSH
  T1E5D2748D7799B162927734B0D07F540FA137A966B94C84E0E181E8E07D783AC872BF9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12 behavioral13
- Target
  Lateral full release/js/libs/pako.min.js
- Size 44KB
- SHA256 29cfa0542b9864b6640cfdcc8f15b184db6431b532db2702a3ce97e5f2a7fc1c
- MD5 64413eda72405dd1d28bbb64d900c778
- SHA1 6086b751c4f4c90bbd0521b6bfe5279fd4eb55da
- SHA512 7ae59cfd0bfc2a9d026d35f533e43706f532a0e6aaf40bb9d134fbbf3dcc15fe6f7abdfdc9babacd5f919e00d8f1e37c0084058a0c63c18bfa8e1a0fe78eaf7d
- SSDEEP 768:7feBUDB3FA8/nVPg0kKWslV7hF/PGjMhuAEIzg49n3cG:zeG/9hF/+jZAEI0O3cG
- TLSH
  T11A23F6A630F651A82BE118D8909B2B96217051326C0519F9E378DDE43CB4DCFE17FA7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14 behavioral15
- Target
  Lateral full release/js/libs/pixi.js
- Size 1.5MB
- SHA256 9cf328099f50e4ceca874d875abd3065e8189133e01e5f054bf7627eb6a960e6
- MD5 25883e75a333c4d6ba534533af414bd2
- SHA1 4765c8c6f38fbb9c8186b8230d0dd1ef9f37e381
- SHA512 eebe4d2f31f102ac3a7462a044615c2b839b0d7548ac256f967227f82a1ff19b09adc283bd6bf3dc78cd524fd5115be2db5f4d2211a061673b3bcc889c3f7c7c
- SSDEEP 24576:+j8IwfSMnNlQ5xl7xOmBomtCZ8oPESkcDnoPy0ylzlZamCAgoeI05sVy0XMQmlpq:+j8IwfSMnNlQ5xl7xOctCZ8oPESkcDn/
- TLSH
  T16465E786BBD9A521FD13215D8F9FA644F236901F9685CC88780CA1B43BD9B3406FDBE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16 behavioral17
- Target
  Lateral full release/js/libs/vorbisdecoder.js
- Size 79KB
- SHA256 5024fbb4606a89caeeedcd57c94e7f633fba40277d4c1d1b2277ee7d60905498
- MD5 079d9fbef8ba74a03d2783b584b8fbfa
- SHA1 a4e9f3f5bfa2750672803782994a1ad29ed51e7a
- SHA512 0c03460bc7ba66da7bc76f5e485ba26e26e48cfbbd1b7718481e355284b30812e80bb91df418e461567369a2cf52503e0ead4f28e7566365e0dc6c0e3ad2b208
- SSDEEP 1536:hHjDH9V29QO6qkTEoUyXJZ+1eUhHX+UIYuIynKviw:hNV29Q6kgynuHOUIYFynK5
- TLSH
  T10A832B7783D33E7FD7315E66920A1F07ACD8B1538368175CED8CC9E064A487A942DAE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  Lateral full release/js/main.js
- Size 4KB
- SHA256 122d02193c3e89c81e21cb5e7bee698f1f473ea55af31b91c3e29e28c04f871f
- MD5 6ba7561830bfefc8de16cac70f7b0242
- SHA1 b4ea893a6a2dd3c2156166ff29dbb775da5523df
- SHA512 0a8517b869e849358aa68d5dd0c7e48f44caa7a7352cddff8b6b6e290175bce942a52e55d8b68272b98765de64c4b7d8f81955870b3e557939d9d98f1d9684c7
- SSDEEP 96:/3NHGeinp4eOVftoTm8arHAhwPKJq8uM7FqqC:FHlMpWlPxghwPKgNe8F
- TLSH
  T1FBA1CE090EE74C278017B09A2F1BA100FA2591131455DA4D3F8CC6D59F2577ADDBEFAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral20 behavioral21
- Target
  Lateral full release/js/plugins.js
- Size 1KB
- SHA256 23c97d60a7815924472fb22f0fd7342992a5c6227c4184a3f0f5a12fd0d6876b
- MD5 d831cd09f9ba1a418b3ae3b3cb743119
- SHA1 197c600ca9316e8c6f54b0792619ab25e454e508
- SHA512 ddac9be22b43b0b769e779277ea5e4488bbd6f0b8c162e883bb884404ba31a2c07b9ccb71731b9126a1ff2b152c29c3bcb274467164bc3aaeaa18a18c1575561
- TLSH
  T13841CA421B45A5B8958B4710283CDFA5BEBD039B741E88C17CCFAC1C00165FAFB6A316
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  Lateral full release/js/plugins/ActorPictures.js
- Size 24KB
- SHA256 83217a7e0321453492b5e195689ade55e773ef48139ea7dd7d04bc837b072c41
- MD5 651be3853eea5a490e85d7baaf29d41a
- SHA1 b0f3be9cf63a2be55a02fc493272f2c31b58d3d5
- SHA512 78b121f6ad2a1ce55c59551cc7e414ac104fbc5cff4bb733b9a422103f0d82860f472f22cc207213f360e76b21278c3931b21bb17c159fcdc06fe4c0f2ede0d1
- SSDEEP 384:Krxpav04tTTA41oVHxYFwyHNBzpcZsqqCsufrLTgw+eG+8+pM8:KITA4idxsxSqJi9pH
- TLSH
  T194B2543EB7ADE0154316A1B115CFA840F6205E1BF893EA1E70ACD2646F1329DE719FB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral24 behavioral25
- Target
  Lateral full release/js/plugins/AltMenuScreen.js
- Size 3KB
- SHA256 6c062238c55ea09303c20419fa8a69c31e533a544c5414495fddd551c562ebe1
- MD5 e80fe2298197d18d92155cd5bad9a57e
- SHA1 941e66f52a6337fe0f79c2118b5c2fbb5e79903a
- SHA512 f74701c4266f7b935d407d22ebb5e22c3c36b5c8ea281810ada8f9f64e1db22d9169bebc5ac02697c96c36573744bfc3bdc18cd144ccd13d98e9715019d3b0d7
- TLSH
  T1B361DD59ABB67030C132606A074B9748E166152F7007C48F7B6CC2989FB2784B6CAFFD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  Lateral full release/js/plugins/AltSaveScreen.js
- Size 4KB
- SHA256 ba98b8c4a554e08a00cd895f0b8de909781ecb9209092c2272913d055d354eaa
- MD5 ccd2bb6b1e4ba3afc79b89f3ec0f52c3
- SHA1 5805f75c47b7c713b165eed298b38ebc408f3ddb
- SHA512 c2d268e254f4e317b04d613a437a8b535c5b9b0bc2fb6865e4182ad7e2a347f5d91810440380eac9dd2aed952990e2e913143de28d6a821d131112c516891224
- SSDEEP 96:Y+qVQ7pDwyhq9okpaj9CTz41vKtwFg9FIOtUO79X16i3Dkip9y3:Yri7pwyhsbht8iN16dYy3
- TLSH
  T1CD91DD899BF61021C432309A0A5B9B492611C53FBD07C5493F5CE3A4AFA179686C6BFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  Lateral full release/js/plugins/ButtonPicture.js
- Size 3KB
- SHA256 e0465802bb656960ebe914d52c800c86f27612e02285156adea681c2bc463479
- MD5 efe46c3606d8cff9050126a309dbd6b9
- SHA1 d8c3276882db02bc81de92c84136ff1e6eefb852
- SHA512 be026c801af252b6b35ad295cd0a70b7bc8bbae76fa1f326df84d18dc6369fd8d3ffd73acffbb497e2b9f0f894c012bc3b0767d38ff99d9e0d4d0cbd31985621
- TLSH
  T18351BA0C67FCE102423061B822C77D94F2054B5FE903A95D39EEDAA53F69B9CC646E71
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  Lateral full release/js/plugins/FOSSIL.js
- Size 282KB
- SHA256 b4ac7886338ac5a58a8a8d36427baf5099009aa7ec29c7669ae57409add83b27
- MD5 8ecfe335fb13d7ba8ec825dd8e318c82
- SHA1 ebe353ee4027e79081b1e35d1c3ad35be9363a6a
- SHA512 1b2db51d4880c8084ddd73d4936de4a01993d7c4248054251640574828cb54ff8c9ac86e7d563a4bf55c613d285b3fb742a0b1fa7fc320a7709c60c9c12c20fa
- SSDEEP 3072:GLLqACQX9kH3AFoV1Z5wL4BP2i5Equ4rK1wn:sZCw9wAFO1Eqr0w
- TLSH
  T14254C745F7BD906986F03021903F56099A3EC97CB06140D9B459F9ECE8FA847872EBF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32