f3fc5e2003bf969977cffc5e4e357ef5a1a0c2c9cc755f88253f8d6d8e3f4aef

Sharing

Copy URL Twitter E-mail

General

Target
soc-optimization-unified-v3.10.12.zip
Size 183KB
Sample260703-wtlcjsdx7s
SHA256 f3fc5e2003bf969977cffc5e4e357ef5a1a0c2c9cc755f88253f8d6d8e3f4aef
MD5 316e14bf34726eb8496f1519b5a98f27
SHA1 2cf21e01b8e58d2d25bfe1b2df771f4e4c9379f2
SHA512 52e6c0042ec6b3f1987ba72079a9edeb61323b71bd44ff2ed1e32b0df9981ccf16fc7e48a166930e7f585326b05889882d34c6f7e34c0aaa7b424e6f4df4d1db
SSDEEP 3072:wISs68U1jHaRzPkbNViEDfCcsY+mU5QQeepLsJtZKDZhS8a9A:p671jCLSNc8hsY+mvQAtAapA
TLSH
T197048EE449C07503D60B90BBDB1AE189E3FDFDC18092A58729EA8A81D757B95F733306
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  soc-optimization-unified/Integrations/SystemXQLHTTPCollector/SystemXQLHTTPCollector.py
- Size 1KB
- SHA256 eb4ff7f0664da10c6f44c8df7bac1764e70ae3ff16d6a61e87a848b4d44abb15
- MD5 c89d59f18dfc4a79a3852bec66fad5ab
- SHA1 ca9f82b9c42af67a0daed435d5ecd8eb5267aa4e
- SHA512 7ae62ddf4fb34ef2c080c7650524916afc3da207f96759aef6693923badc430e1cff3225a36a6843c142f6e73f164463d5084cddeddfedfa875f4ca2dbbec686
- TLSH
  T11F210DA7D5F4656217EF816CA18FE8032629AA93351018713C1C2E898F64D33C8F24CC
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral1 behavioral2
- Target
  soc-optimization-unified/Integrations/SystemXQLHTTPCollector/SystemXQLHTTPCollector_test.py
- Size 5KB
- SHA256 e622008ed704badbfc534038df41e10d7c307da89789b2271690533850f8568a
- MD5 b5f25905aa90e2dd3c50f2568443a07b
- SHA1 f132f37957c537ad2a034fdad1455e95d4f36328
- SHA512 1f3371a8baa17f32eb14f7cc180b5a3da627fa3bf750d3b092942fd20c8aae6a1cb4434fb894f462811cc81f18ceacb65ff6680a4008f289feded65528c39bc8
- SSDEEP 96:kkHQuykkJT4seCI9IE3MBzTDfTpV8xjTl3HMc2s:kkHylTjeCI9IE3M9TDfTpV8xjTl8vs
- TLSH
  T1DFB167FAECF2E41255C7B1D46327A027FA164917214D786AB7ACEAD00B2CDB49CB111E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  soc-optimization-unified/Scripts/SOCActionFingerprintCheck/SOCActionFingerprintCheck.py
- Size 5KB
- SHA256 827735204000e9f598a955f17ab5a25b1c3ea5c77c8135f84bbf8103c35e6912
- MD5 68085f1a2a9c3c0912db3d66c3bd5623
- SHA1 b46b16154e1caf7bf2e4f40b59726d83b48333fd
- SHA512 9793b706f43b7f2f623ec85ab90f063393d7bd2953ca86e67737334e401b7810ec31d2d8585a88f4f737fe454958733dfaef87d48230b99a489b07cb54bbee2e
- SSDEEP 96:1x0wM0XveTiZDTHcgk9pvdEgA6B5RZ5+y65EJiApWg6sX1XbjgQBYOMC6wO7dl:1xhtXNP8l9pvdEgA6sysAogDX1XbjgQK
- TLSH
  T124C16326E88425710FCBA27D95939343EB75482B18193E707C8C82AC2FF59A491F7BCC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  soc-optimization-unified/Scripts/SOCAutoTriageScoreFilter/SOCAutoTriageScoreFilter.py
- Size 18KB
- SHA256 44e44286342d20a04664aec71276a5a2f7328605d76f7b1f2c01ef956b27477f
- MD5 976866d6c5023fdf81c7e36260ec2c6d
- SHA1 94c2b81444cef483c5fb1d88f94c5d674910229c
- SHA512 46c2288ddd6de66b3dc9332b12f2da859d4c1002d51e8dcaa66e795fd37f6ecc3d70a1e41a0da11bd5e7e6ed8b031cb304894833377801c4d40f4fe237e68643
- SSDEEP 192:cBswm6xO+HxJyMFjLVw2Rc3JZ+tgCNI77KyDMsEcrxKi1Nl1xQfQXJ+Bf92RKpEj:+FmMO+HxbF03VjH3LEcrxKi1HuQZM2sS
- TLSH
  T1D182A776E957072A9BD3809FB65B1291935E646382112A68BCACD31C3F4C13AC27B1FC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  soc-optimization-unified/Scripts/SOCCommandWrapper/SOCCommandWrapper.py
- Size 37KB
- SHA256 8301364a71ebefc2a8989bccfd1f8e28133d49b726aeb74c7ce6d266addbf105
- MD5 5f71a6dc8f3f5cc28e381e4af0650e0d
- SHA1 2c0378b6e3d5679c9aa704aa2424ca3bb225c0b0
- SHA512 0c95ec1244c15e550b1eb50bd47a2cd42ee10c73d4a744a31c6a5885303f8c0bc8d8890288ed0fb5dd2ade5af40cad66aae76bc4dc7d4000d0e3746a904b2d9d
- SSDEEP 768:/Mrw+DLPZjYiX3for1RCyBwt2sYJhFs4aSkMt25Ub4JCygc:N+pYiX3fop75A
- TLSH
  T16503B63AF82424329B87D1AC595B954363346413AA403C6CB9DC855C1FFCE6AB2F37AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  soc-optimization-unified/Scripts/SOCCommandWrapper/SOCCommandWrapper_test.py
- Size 11KB
- SHA256 81b2e6d95269ff86b112c47de454979d549b5af2c0ce301ac60a38ebba2e01b6
- MD5 8581b4605bcd262ec2ddb50e4ee76182
- SHA1 da2a4077414fafb03b95bed913e9a554abc9c20f
- SHA512 afd0547b72f9dfbcf5c04d93bcf738d7cce90c2266bd26c23bd6b716e69bb6d90f68c7221287b1245ef0b24fbd2b29a1090a825fef84e586c1340e697bd34725
- SSDEEP 192:yAnQrvpH9x+yvQCccrW8lM6nYwG8YeVhCyiJALnglEOhFylMskCyip0Z+AS8Z2yT:ycyvAwBZFVO5W0Z+AS8M4JUpMt
- TLSH
  T1ED321119ECB05D2243CB61FE24AEA413F635D56341087DAC7DDC819C2FA4EA548E37AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  soc-optimization-unified/Scripts/SOCCommandWrapper/SOCCommandWrapper_test_soc_detonate_file.py
- Size 23KB
- SHA256 a548ab2c033aadae9926112b232d48b72c1852a238fe18e8788b2ecea9dc4d68
- MD5 ce7c467521a7a705410aeb7eae1ed804
- SHA1 12f26c3888cd88ed3927bd56b36c635750141d2b
- SHA512 1d574c04a7cb43c1a2f8ef30b5a4023518dbd6aa6ace88040e33ddb0de5e0a2fb16805639f725cd357b0e82111d2e509eeab45aa468b1d329a19601f4bc24704
- SSDEEP 384:ebwnj4yvAMoWiIbuyDbGoprIIQiDDM68oxa6DmYA60jionbJhGop2vnA1pim9CwV:hBAMoQrRIIQiDDWsA60j9JuYk0d
- TLSH
  T167B23F69B9A52E3362C3C1BD506B9003B334A653B5042D5839EC618C2FFD9B942F36B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  soc-optimization-unified/Scripts/SOCDedupComputeWinner/SOCDedupComputeWinner.py
- Size 2KB
- SHA256 54280975800745b7eff97d78695a3a3a935911034cdd354fb05bc8852901ed3d
- MD5 2e8ad5868579cc4118b245d6dfc41349
- SHA1 680a7eb51551a832aa9db1faed4963c331ebc65e
- SHA512 8eccef5135a9b6ab4ecae92da03f2436662e0b6395630a909fa1ee2e936c308c6c1f310cdc2a183de0b56abb6ade90a72e2aeefbcba7015e0731eae8264a4919
- TLSH
  T157413455991A3A248797606E2C4AF6069318D71360102568BCDCC0592F799B9D3F7B4F
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  soc-optimization-unified/Scripts/SOCEnrichFromList/SOCEnrichFromList.py
- Size 8KB
- SHA256 908ba8566bd812efe8ec40327ee4ede3367940f30a522cbfc444bd95f30e7a3f
- MD5 a83ceda990b89b3bc180c7789d4dbe2e
- SHA1 aec6c488da496c9a7f30ac9610e26364fcdc591d
- SHA512 47d75a8a9c04b217d48a4f4e6f02c86be4518cfa63889ce45fe830e62a2fdb317e6040473bf68744353b755de74e3b40b251a1c2416db43b9054b1983ec9e88f
- SSDEEP 96:7vfuBeZG1Ot+eFOfeMtcKP/fWOM5YDpQCAGWQObWbgRtE2pyq5X8pgbTwrj//moX:7Mu8bfekcQAYv5WQQWbgLE2Ye7bSVhbl
- TLSH
  T154029627ECE4269286C7C46A6E57D103D601C40391102D28BDEC966C6FA5FA8D7FE7CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  soc-optimization-unified/Scripts/SOCFWHealthCheck/SOCFWHealthCheck.py
- Size 37KB
- SHA256 2617179689fbcd25b5b5ae5eb71ea5218497fbc230e0061cc14abead7c7f5e1b
- MD5 caa307b4f0323495481e3860d7b1f5e7
- SHA1 1f819c49a916f663f5e799305bb18aeff4ba2179
- SHA512 3aa23c40512ffc4c6b4febd1af99df7072e6567c4ccbffa9d0a037211383a17cc1892359356a0b30683e4204bb9139fd72468843a68a267c7ac62436e773f367
- SSDEEP 768:RsCaRLnqfUjHn47waFaPEgIkONe5YFN+Eyinwwxz3VKbX:RsbVGqHn479e5YFMEyinzxz3VKb
- TLSH
  T16003C8639D291C2387C681688C4B91127718BA1317546D287FCCA37C1F6DB2EE2F75AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  soc-optimization-unified/Scripts/SOCNormalizeFromList/SOCNormalizeFromList.py
- Size 17KB
- SHA256 afd676613b9b316008c8ee6588a3b1fb750dbb73343d2d54334833c18078d6aa
- MD5 cf97ec94a4418097b4440d44f7481b83
- SHA1 726212dd310df6ec5042288c678ee88668fd2da5
- SHA512 e2d6e4e405a97943ada79c2de51e32a84be3ead1ba672d720c563b0ea3c9414003163997bdf71fbccff9c5f91aac4bed6b5059300afad689de1c814278b6f629
- SSDEEP 384:KxK6ibl6jwSnASC9F9z9z+y057cJcjAgkj0SKpQRT:mKNbl6jwSnDAV057cJlnj79T
- TLSH
  T16482CB27ED7D09A146CBC4AD089AC243EB20D41359022DE47CDDCA481F79A6593BFBED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  soc-optimization-unified/Scripts/SOCNormalizeFromList/SOCNormalizeFromList_test.py
- Size 10KB
- SHA256 8d5456f247419b6d115829b29399fdbc19ab02985673e6cf9abb15ed9d49e2c6
- MD5 ed69aa3dfa26987c15df4cc4908f0df3
- SHA1 6957dbabaca4b4dd80384366068dc8ab6b2cb90e
- SHA512 d87e45a66abbe167caa1b509bc6eeafe9217dd18a2acf4eab81b9ded6b5a28516afc3526483d8977c274114480094294e04d25f1211bdd012fb139b0eae95e4e
- SSDEEP 192:bVhFLUovF17B7BBGm83GxFEKEZGE68LSTeOAKEP1Yej5YWGYc8087sGEa8/+044Z:bVhlv7ddBpUVJ0VAPPPbJcXF0b044As1
- TLSH
  T11F329416A83E1743028584E5F159C6C37D20C293CEA83A24BAEFC2195B3DD5EA47B7F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  soc-optimization-unified/Scripts/setValueTags_V3/setValueTags_V3.py
- Size 6KB
- SHA256 01f094830bf4f1bd0ca0f82fe987ca7b62a89a62b435fcdb518f04352541642c
- MD5 947c96b7827f160bdd1866b09e9e1c04
- SHA1 5b41d7803770ae00ae719dfa52c3f5eab265bf90
- SHA512 1973bcbdf62024a49ef9afd6d8457f1cbc5d6c4743157e9a82a0697c9eee0f919dc11c110fd1747c5faf6439b76f7de7a6b58c4654526c2a8c6f5d67175cd80e
- SSDEEP 192:pezZaT2P8mOX7ZCEBmO/wOQd9ZnbK4PXjQyooniQbVP6JsE0BELUOXFEm:pqAMyH4Ww5jnHGsEfLfH
- TLSH
  T122E12675BD7824624193C02855CAE003A6343D1309153EF1798CA2BD6FA4CB6EAFDFAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  soc-optimization-unified/Scripts/setValueTags_V3/setValueTags_V3_test.py
- Size 15KB
- SHA256 35a6891de14ed322750fb07be4370be5430453bbbc753a2833017e015c8d2d75
- MD5 fff6af838d41536afe3a831a1add564c
- SHA1 58b2bd49d497dafa9bc364acde40c9285f525e3f
- SHA512 895bdc4032df7904a0ad4e865c4b35cef13f6f108900e2cd7928dfc80677d419fcfc4e57844cf79ee59a010d1f155451ce936ed64f067e760eb8e9082af837fc
- SSDEEP 192:yriV+gdC/w2iygVRtqDZUIA+StV5D2XGt4O0DuzGoDu+y0D6EwAmGjYCydy4NB7N:yC2/w2ilmOsdHpmPUg4
- TLSH
  T1F162F26A5EF6A9638247D438749AB52373067B13012C28647EEDA2FD2F5043AC8F57E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral27 behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28