80f3f36d2a6201acdfb57fafc88b79bde1099c10ec350d9fa898cc55fab14423

Sharing

Copy URL Twitter E-mail

General

Target
wms2.zip
Size 2.0MB
Sample260705-zahn4afw2s
SHA256 80f3f36d2a6201acdfb57fafc88b79bde1099c10ec350d9fa898cc55fab14423
MD5 5a79fcfefca3a52bdfc7501653f78ac3
SHA1 9c8e06125ac386b5b76b36b916005fb128e4ac2a
SHA512 35ec6514bab72f2197074dce8dc1b30d328e4df291e7614fb811526a9e85bf9601ce00579ae3561184cedd3a92b358c9ad946adff9b47b056d4679dbb46250f4
SSDEEP 24576:6VJ9+GeeN+nYY98VxXX8rouR8qk+YdWTEK1pwYVAFhRU5ECdmnaS8R9LZFwYP3K2:6VpeeN+nQpX8suR/TK2gaS8ZFw83KwDz
TLSH
T177A533C424D2B776EC1025BF2985E6C5A9DBEA5CEF24C8A177692C3434E02613BF167C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  wms2.zip
- Size 2.0MB
- SHA256 80f3f36d2a6201acdfb57fafc88b79bde1099c10ec350d9fa898cc55fab14423
- MD5 5a79fcfefca3a52bdfc7501653f78ac3
- SHA1 9c8e06125ac386b5b76b36b916005fb128e4ac2a
- SHA512 35ec6514bab72f2197074dce8dc1b30d328e4df291e7614fb811526a9e85bf9601ce00579ae3561184cedd3a92b358c9ad946adff9b47b056d4679dbb46250f4
- SSDEEP 24576:6VJ9+GeeN+nYY98VxXX8rouR8qk+YdWTEK1pwYVAFhRU5ECdmnaS8R9LZFwYP3K2:6VpeeN+nQpX8suR/TK2gaS8ZFw83KwDz
- TLSH
  T177A533C424D2B776EC1025BF2985E6C5A9DBEA5CEF24C8A177692C3434E02613BF167C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  ImGui-Menu-Static-main/KingsleydotDev Static ImGui Menu/StaticFramework.sln
- Size 1KB
- SHA256 9ff5ed4129172b48349222c3afeec870878df5b6f25b5abedb44301acd15d35c
- MD5 8b60dcd809a13f653eafcab411f8926b
- SHA1 30d7a57cc6ca3f3cd70d80a6087041c405b222c5
- SHA512 ff64ea702b5df0a844c995c8db44f086e44658f0075643a9e9ec2acb6181f46c414e8619aa6e533f86dffbfaacc2af2106a91b8bdb46e726d11f512f06f7963a
- TLSH
  T1E22107ECF12D75A04D9712CFE268DC5B2A7283EC829A0D7C0841155D7B2B6C9825B8F7
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  ImGui-Menu-Static-main/KingsleydotDev Static ImGui Menu/StaticFramework.vcxproj
- Size 9KB
- SHA256 415d5a644de04238a09827a38999eafab92f234fd17855092b1ac7ed6b04b8a4
- MD5 8699d33b5abae4d26fbf20a92d433dcf
- SHA1 708d97451841dde1c146b116dfaf29fecedcf951
- SHA512 18ec427779928cdad8f66bae46b82cc52f05c9d15e5b62300958bef49e3527fb89cecaafd25671b1f092f47f640c47b1e9f45e9a2c019934cba1df7d6c406aa8
- SSDEEP 192:UcDwYXYXxoxj/SPczws/6PczUV/lPczUW/NPczUl:Uc7/KA/Sp/hS/JR
- TLSH
  T17D221F56D0FC4B5BC1970627D2D6D9418EB1E3931E5A886CF68E93996F5B0086323F33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  ImGui-Menu-Static-main/KingsleydotDev Static ImGui Menu/StaticFramework.vcxproj.filters
- Size 2KB
- SHA256 a72ce69c89049720f73039423f34fcc7ad24bd709dde3070db1f4247d39d51fb
- MD5 e93b61b2872a24384144992dd41ed7e6
- SHA1 ef4dbdd15a5b7509e2774051f64033827bf2dc8c
- SHA512 48866c0b8fdb6d50bb8c2b674c099b100a04cba0f70b1304cf1d6f17aa93c041aa313ab14242277473f336eae79ea05f1d5fab5685a708dd1b6673e4d3512399
- TLSH
  T112517236C1FC4ECD40220DD7F790EE065EA5B3E3A45540943599D28AEFD390AC12B72E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  ImGui-Menu-Static-main/KingsleydotDev Static ImGui Menu/StaticFramework.vcxproj.user
- Size 168B
- SHA256 c06a75b13f855a94d46616796e024c52b499f8f92cf00ccb571ddbc6ff574676
- MD5 244d056f5e959be6d9a2f7e94686f1c8
- SHA1 3ba38385380485d9ff25eb142eca0a01d8ce2fab
- SHA512 8d5c4c9e54c85c90224f7610fef69d9c7e8d0db6be369181ebed13e2be9c86b651a438f1978f99c3ef432a8cb6bc5b8df26c476e7e5b32511d0d31cd49b55f20
- TLSH
  T149C08C449600E821B7B0AA3493ACD87CF3FAB2E324F088ACF6D4D90D21071A860213A3
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  ImGui-Menu-Static-main/KingsleydotDev Static ImGui Menu/ext/fonts/citadelofblackrose.h
- Size 598KB
- SHA256 4ca3bea3cf261d3dcd95a709953c866cde32efb62eb71cc741e71c2b0da89552
- MD5 c3c14d7ac06e68a01d923c7f8bbd85d6
- SHA1 44aa313604de1ad567fcae0d4463a0b987a74759
- SHA512 e5f5d17bf618fd9dd6af3c1e49e7191bfd2545bc3b608686a745fb6ff68fc47f885cdd9b4738ef64555a0e1e57aaa8a6080468ef67528d984c2a86096baaebf6
- SSDEEP 3072:a9IGI1vdQ206lDpl7sgnbpLUvV3X0nGbJ+6ZqzhRLIVMgW/8DlHwtePM5jo3FvoD:SSCQ
- TLSH
  T130D492EAB70C66C4388B326CD7658953E6CCA93801E185CEFF9EC61EF0CB81545A671D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  ImGui-Menu-Static-main/KingsleydotDev Static ImGui Menu/ext/fonts/fonts.h
- Size 1.6MB
- SHA256 7fae18987229e51ba7e46d2332dba116d846a585e96a26e2bc0cdd1712e2a5fc
- MD5 717b083f04c38151f6d7e0bed1f632af
- SHA1 2ab005a16c1afae7a1e762aee59070108585db7d
- SHA512 9c4b03b4a1f22b7d54c7e50e44928fdd843ff8b80d18f8d91838c6e407b71622f3bd5654ef71586c22009937c618550494db6bd1a0d4503b720fccef08d14b29
- SSDEEP 12288:g/FeC8G17g3Kiivf/33IoiOdkF6twm1lt1c6YU8ffsfyNwSvL7rEF+Nn8HK/brLi:8
- TLSH
  T13A75CAD6BE4D91C4284B326CDF6548627D8C9A3911E1868AFBBEDD5FF08EA1900F171C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  ImGui-Menu-Static-main/KingsleydotDev Static ImGui Menu/ext/fonts/iconsfontawesome/IconsFontAwesome6.h
- Size 74KB
- SHA256 bf3cc8e44db447d00b9dd7eabc62c8a062def9007dbf1151d96d33a34dbbd17a
- MD5 15b747b44033b620618b66ab1a48eb92
- SHA1 b9b7d6fff695d3433b37d9e9984b101c5e02ed44
- SHA512 99216f4730199132f00569c840f1dbc32cddad6d3d1a2bca546a4799ced98e155f894a524313407eb7ec5f4724f1ebb894e95e3d7641d03bea5dfae0e94968b5
- SSDEEP 768:E2Dwx278A0zLnqEbMY3xD031S30S/FG5y4no0JK6yggOZ4sXbRk5fz52KFcjH:E2D2L53uBSUO6ygNZ4sapYH
- TLSH
  T135736FAC09D3A7CE9CEA2417897BDD9162D6C833548058AC75AFCD2F284067617F378E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  ImGui-Menu-Static-main/KingsleydotDev Static ImGui Menu/ext/fonts/iconsfontawesome/IconsFontAwesome7.h
- Size 73KB
- SHA256 48d2058397b79f6ae87d754a73b43f8ac434fa9d9bf2d9c5a07a73a6668f2e49
- MD5 c83706ac13fa82293d7550909031e80f
- SHA1 dc6d35c03de6bfd440c2ba4a665e59c83c723d73
- SHA512 3d37c0fcc03bf67adec20b335bf3919f409c0966b902491e8cb433697ca8cf06f34cd9f6ad2c46ce09443c9885cb92c5eeb4bcda5555e51fa233eb4621a3af85
- SSDEEP 768:/VG5/jzWN8mys1SA348yaiBMjfhsyVEqJdvfjDkRRGZHg:/s+8xQvyIhsySqJd3w
- TLSH
  T199739BA109E3F7DE98EA0417897BDD9166D6C823848458AC74A7CC2F2C406BA17F57CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  ImGui-Menu-Static-main/KingsleydotDev Static ImGui Menu/ext/fonts/iconsfontawesome/IconsFontAwesome7Brands.h
- Size 27KB
- SHA256 54967994991bfb763c027ef21d58a58e44d218811e30a90f04fecd1b46bc520f
- MD5 7588abb943fa8304090770a9859ed918
- SHA1 5bbb8d5059fe345a6a7616102a6ab3c193b405f3
- SHA512 d34d62d8fd1c551aa6b6d33a87391bd4833c067d286a8dd0600c2f166b08e0470373e416af1b5115ee54604bd4a6a55ada7b94631adad4be689eac55cee117b7
- SSDEEP 384:UvLkVc2ZzzGU1c64kLxW3MtwotJGNZTBqaEuZ:mkVcozffLL+BZHH
- TLSH
  T1F2C277A409E3A6CE88FA4117893BE95166D7C833958059ED34E78D6F2C4027A1BF47CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  ImGui-Menu-Static-main/KingsleydotDev Static ImGui Menu/ext/fonts/iconsfontawesome/fa.h
- Size 4.2MB
- SHA256 f148f8ad0d743a9e7c3aab8732c2d5d590537ca872890722ebc1a9548f3805ef
- MD5 06f86a83f5b730bd10c8a9eb036aba10
- SHA1 25d214e38b013dab0e5966720bd6f7b9ed15e96e
- SHA512 9a9b5b346c773574d5e0696209b8e7f1e680a6fe001d2b6d03e4f61cd50ad1c5d95e7bf817dd712938d1642378b9e5a3c2ecdcd784ca2945ed88873da3afc36e
- SSDEEP 12288:VE1FFG1XYQf9eaD+UjEVjd4ltCtcN5ScLjpIzx3mYg8UoicDq29O4knIsfWOaSjd:n
- TLSH
  T1A42687D6BE0E51C5288B356DDFA54CB27E88553621E1858AFEBE8D5FF08DE1904F2308
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  ImGui-Menu-Static-main/KingsleydotDev Static ImGui Menu/ext/fonts/iconsfontawesome/nw.txt
- Size 172B
- SHA256 e8cf162e8dbdee878fc830974c122094058945eace72f81f1d9512fa261373d3
- MD5 89a66939e2aa18f2b31922d97bc4c438
- SHA1 945fcd8d416b4ac146a8eee2dfcd9b73279f7e97
- SHA512 be3afddbfaa692ef7e4bcdde13e10e2bc45c57bef716dcab1651a68bdfe245c99ce0f99cf1dc9dc0106d734f703c32d4b193da91439cd395aa658031860bbf5d
- TLSH
  T1C1C0805307711DE9139303E7754E30CEAB7560E57C660819635F834D53585424A14D45
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  ImGui-Menu-Static-main/KingsleydotDev Static ImGui Menu/ext/fonts/nw.txt
- Size 172B
- SHA256 e8cf162e8dbdee878fc830974c122094058945eace72f81f1d9512fa261373d3
- MD5 89a66939e2aa18f2b31922d97bc4c438
- SHA1 945fcd8d416b4ac146a8eee2dfcd9b73279f7e97
- SHA512 be3afddbfaa692ef7e4bcdde13e10e2bc45c57bef716dcab1651a68bdfe245c99ce0f99cf1dc9dc0106d734f703c32d4b193da91439cd395aa658031860bbf5d
- TLSH
  T1C1C0805307711DE9139303E7754E30CEAB7560E57C660819635F834D53585424A14D45
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  ImGui-Menu-Static-main/KingsleydotDev Static ImGui Menu/ext/imgui/imconfig.h
- Size 11KB
- SHA256 5d6cd72d170b96335686121b143f1991948f918bcdba75a19910b1ae6aeab531
- MD5 3760691362814d7e4c8b24b4510f0b1a
- SHA1 1f3d80045cd70c5194b473c3d3bdacbe88ca3f8f
- SHA512 a910e5ad1a883c3f707fba1dab3125ad5ac64fb1f21e6943ee4e09d84ebf15c2676712acf45e0c15542e939e3f19117b7e86034f55a4970c0635f00f9297eafd
- SSDEEP 192:TfgoLRD4IuDKRvXwJzdCcQqCb/wGlhYxFlH12NwcD0aUln5XNZCCIsmYU+xhQftk:TflDO6WdCcQq0I2SxFlH12NwcD0aYn5h
- TLSH
  T12042D50B3D4A22500971E571BB5E8175DB19CE7B7340E0D8707EAA9C272882E11FEBF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  ImGui-Menu-Static-main/KingsleydotDev Static ImGui Menu/ext/imgui/imgui.cpp
- Size 935KB
- SHA256 e6957a51de745c91be1684c18cf4ce749ccb3482ff931763ca10cd12a0576fa0
- MD5 29dedaa230ee3843187b7c6eaa23f194
- SHA1 1dacc893d3bc93235f0b67f7602d68e97e7cadaf
- SHA512 0e2dcf66d9d6ef0b3e4d9a2aadc69f801c9bb9b7608b3476dfa6ac85f7a9d2e93277912a9e57988e2080cb28063ff8d00d054dc56599ff55ad302b7fc5171950
- SSDEEP 12288:smafCaYK16txyzisildB/vihjiPLvdigLWQ34bAxfR/e124Zovy4NEkVtIUoQmCO:DafS/e1D6/S
- TLSH
  T12D15F8A61C6335169972D4395BC7A346EB3A49336794C5107A4E238CBFC403386BDBEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  ImGui-Menu-Static-main/KingsleydotDev Static ImGui Menu/ext/imgui/imgui.h
- Size 412KB
- SHA256 ae0d22777fd4ab752d78239fbf9cbf7f3683167acfd7f6f808005476a9d89ed6
- MD5 1fb3b17210b94bd5968c3c042fd2befa
- SHA1 192ef2a4b80b45494aaa765310a519df083b80c1
- SHA512 4ca636790a728c27b0c6b3569f1b04819933cfe73f2ac8f7ac3d1d9d709867889c3d2cab99fc5b466d3ddc74fa216f9860a2ab858c3cdf22f4b2aed59a0e8654
- SSDEEP 6144:kSaY1G4bKcx2uFKcvcxTHAdgYFAgxf/3VhDSFt4aM3pXlgN:SmKa2PcvKTHAyYF7dwaaMsN
- TLSH
  T15E940A472E0132218D32D6516BD6E546EB3C4436BBF0D6A0764F639C2F4642A427EFEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32