0817c5b46635c9e6d604f890c8eacf388d73e333c23b7d328a6cf1090e887f96

Sharing

Copy URL Twitter E-mail

General

Target
0817c5b46635c9e6d604f890c8eacf388d73e333c23b7d328a6cf1090e887f96.zip
Size 682KB
Sample260706-e1slrshx7t
SHA256 0817c5b46635c9e6d604f890c8eacf388d73e333c23b7d328a6cf1090e887f96
MD5 fb3f53939242085ec3cf56eded0e4352
SHA1 b43e5bcced56c7b43c3ac81fb2319c01e0039dbf
SHA512 4defe592137d3a46cbf198254b8d48273f596081b4c6f484c2af05016bec4d91d28c1287b29344c34544cc2fe2433406469793a4eb2a744943c8cfba4ed0a9aa
SSDEEP 12288:OOy7hkiSw/mMThhgB3ob7W4L2L/t5sk0AXEBrzvusM9tmwaxMiZIzV/oF:OOy9Yw/mMU3oPW4L2jtmrNCiazV/6
TLSH
T1ADE42362A12D248ADF738AFA788EBA4552A4CA0B2275C11F7DFC190F1CD15FD0AFC615
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  TrialReset/Plugins/ABBYY License.dll
- Size 15KB
- SHA256 c266d6dc02bab25221776b1f3c9bd8a0c9a7e069016023d3f23c99203da3b34f
- MD5 761fae9b05b37f2d3391799b4b884eba
- SHA1 f94cefe4375529320638f663a7fd5957646ef8f2
- SHA512 f31d595eefba1a9f6639eb800070326559361f2c9470314c95900eebaf1f94a61a3dd1e95fd6a2aebfb471ed4fb353a827e905239ff486d83e48356b46abfad2
- SSDEEP 384:ZiQcAPy7euCA9WoqKB1ViPgr5iSKFFef+BoTT+q4vOnK:ZirAPy51Vlr5iTH2OPO
- TLSH
  T17D62DF63FF185524E0662672422245961EB4CC4FD7EE8E2E01A2752EE940DF8E36D33B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  TrialReset/Plugins/Aborange.de.dll
- Size 14KB
- SHA256 511361674b511bd5878555b54ca2dee927b271a5f5c71fbf3d195ad4109a7ac5
- MD5 9197acb24a08f4bb3f3bce1ec02c8cc2
- SHA1 773794a9f6f27e0c6cafd855fcbd5fca47183b90
- SHA512 6b6a481e7eee4c474fb58a6e6c9558671947e14a93d61955746f71499cd1ff9f13db383c7e633c42ac1b55fe2843c84744eb883d12f2f5b261fa70a46715a414
- SSDEEP 384:9sNi8gsKacjBHFL3lrgGoBExaBq4f8cQCv3:KNi4sPL5u+x+0cn
- TLSH
  T1A862C1A9DB808ED0D2A10E720D93D7582588DEFB83A6816563147CDA5993AAB3C2DD12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  TrialReset/Plugins/Alcohol 1.x-2.x.dll
- Size 15KB
- SHA256 29eb3cbbe5d4ff04bd02335bbc1879d6f05f5500b4a6bc713568cb8591c22ea5
- MD5 05b82df99964d7f334d7827d9b858430
- SHA1 729a647ccca24bf84373e0a368eaba288939e851
- SHA512 036ab798fa62ad70f5336f0602e7d366db59403b713ba57d40b3db9536f8ec21cb4e9566f70d34756cc8d4dcff367f185b8f2d8bc19e1f6ea05b3ee96c1094ad
- SSDEEP 384:qr7dTkFj+CTbBok2VhX7oBHPlAOrU35oSj98Oq4fTcgwdS+g:i7dTkFj+CT2VJ6mz1HG4
- TLSH
  T13F62C047FB469482C184C771818A8BF13899FA16DE4F6079634C362EBD77CF10955F92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

collection discovery
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral5 behavioral6
- Target
  TrialReset/Plugins/BlindWrite.dll
- Size 13KB
- SHA256 085d920db791b265056451ad59b2a1fe3ba638efdd651f78f329d05e1fb83cd9
- MD5 a356d336ba1f11cc9f2464a2d296695d
- SHA1 8db6be53a5706af684ac0c6b83c39b783625f48f
- SHA512 7d0b2a5eba168e0dfa76df4026b524f78e7b37eb92c400ba271a9d8e124307606627d007ba7a0f7504d82a940ec15738de5e439224015c35aa142b53586d3f77
- SSDEEP 192:KQ7CKpJB8EyDma6YWrZ/GLtiqeqrPBDzo9CcCz1U3oqkB+DNCvTLu:K2pfB8E0C5GLJeqDBqCccq4TBQCv3
- TLSH
  T14A52BF0FCE1A598AE0A6FDF141E64B6335AC1D18C72DC1596B50F089ECB28F40CAAB12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  TrialReset/Plugins/Empty Keys.dll
- Size 14KB
- SHA256 f1e20f1d217f173024ef4dc9fa1d56efa272be6bbedfc0a61659be5aea3e1f42
- MD5 1fff3e40c783fe72415c6ed64b57a2af
- SHA1 9cf7f9ac9cc138f9aa6222d562449e8d9b34f438
- SHA512 6bc236a3b637b5aa7e1622e2ad93cebe41a79c345e8734720b7a0fd875fd5bf3de8e07cab14eb44c3c6b5e865cca96487ca8050ec73bfc5be25e834e6cb2f4d4
- SSDEEP 384:aeh1ihbzMBwNNYVvAu3eqymOF8q4qcgwdS+g:a4AOWNWjeq8F874
- TLSH
  T18062AE4ADB1C9246D1F219B99143EA7CAE844C03C79B5897CBC82D2FF8B73EC6455302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence ransomware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral10 behavioral9
- Target
  TrialReset/Plugins/GAlcott.com.dll
- Size 13KB
- SHA256 8af1d77615826eb35340d14b47c5708336147976b0449556df3351d96d2a4ed1
- MD5 34558b5e224db3545d933e32207fd851
- SHA1 5f1968af6a49ebf761c3b2f6947892636f5b971a
- SHA512 52d009be3b158f12dd30263893e6d2f4534d54420f82ea33903a40208487583fa54097005be6b388e7a92445abc73b7bff72ec0ff4fd3ca57806916f74d08f75
- SSDEEP 384:xNwjFUdnAcENISKh03pMXdXgmOFw7q4Dj:xSjF2QB3pMXoFw7j
- TLSH
  T1D0529E474359C81CD8614A7254D7C3FC5F653E22EFEF0E9B6B802C6BF86061A642C745
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  TrialReset/Plugins/Namo.dll
- Size 14KB
- SHA256 8671845c80e848edf2810ed4e272d994a56c3f1f4456b5d347eba72afa00210d
- MD5 5402da6cf92fb03dd8c31fe270960579
- SHA1 f19257b93fac562c29230a84cac958f1ea307144
- SHA512 ebcc41b368b2a9432d7a9aaac3039e0df4b95bac59212a2a74520a12aa46d0eb48234f86531f9dc29644838484616f8da7531a691139f476c9bd86e4462f50df
- SSDEEP 192:7oiRKaej6kRuM/ri7rkklFQy414gYNP2qrLu/1U62uhRAk0DtdkQNynT+vK1U3o2:JUvxDkLQyT2mK/rT0DrkBq47j
- TLSH
  T1E152BF132A0C9F9AD1161F329D7DBA699C9E71D4C36B0F9733F40C27BEA30981D28852
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  TrialReset/Plugins/Reflexive.dll
- Size 14KB
- SHA256 816acdcd693b0d9623255358a96c369c3b4c5e2e9aafcf0e085c70f6ab07c0bd
- MD5 3abcbc02182a4f9bb13a7ea9848eaf28
- SHA1 3688e7fffe7b29a6652693f84db73670f67afe7f
- SHA512 45ebf8ed475a58d178c9630ddd42971d2c18a5a50b3f66ce6f95ac23c829547580c6c905afbf3190fb0b7fc47df0213780305085b573731feb1f38569c0c9132
- SSDEEP 384:6y+lR/7pgVU6MW8bhP4SRkHu32OFTtq4Kj:S4U6MWw4OtFTtq
- TLSH
  T1C7629E829659C988F0F67D32D103D3F99D8A1E43C36E0BCB57A41D27F9B224A3116BA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  TrialReset/Plugins/Teklynx.dll
- Size 14KB
- SHA256 a73e33332df07c9ce154e43f6476d4cf157805263f24029180f012ccfeb05133
- MD5 fafdbc2158ad78149040d0a898d7aeba
- SHA1 cc1d2811b45330761afcbee059fb2c97b9aab1d5
- SHA512 f730d4ba4d41ea2a1f4b4097e0bfeaf195709005d1b781983aad7f8e86902f7d28f3bafd7382f0988a9571ff5259b36457c829a7e6b1cb8a3467596aa8b61338
- SSDEEP 192:YNxdF6Cw7gjUbuqXF064IK/osPVhPanKIK0SHs5Zx1U3oqa94v7CvTL7:YN/EiUZ1p4IK/V7GSHmZxq4e7Cv3
- TLSH
  T11162C057BF084BAAE094D97414A7A3576DA07B9347CFC63C5314059F98E33DB236A102
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  TrialReset/Plugins/Zylom.dll
- Size 14KB
- SHA256 a2c2e54dbdf20bf9489c5bc39280eceb5d6fb03b0dec4eea3f3907c017f5960c
- MD5 ea14bfb9333ccf835223ecfcfea6bb2e
- SHA1 16977a05299ccb7f655b8297fc6c7f33fd7e3659
- SHA512 56ba0edaf9a5cad2adc4f2aa0a6e3491b3dc000c92926e7d85b5168c78328bbe87ce9c1363ad596411b94071f3c5a6bbecde2af83a19e51e3d939eaf0fb3db58
- SSDEEP 384:wPwBWYDBXswyha4u32sVAwIAq4hcgwdS+g:wPfYtZyha4rYIAY4
- TLSH
  T18352AF4BC36D90A4D0BB5A3382CACE78781D6D12D7470C6B53C03D6BF9706BCA922716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  TrialReset/Trial-Reset.chm
- Size 18KB
- SHA256 d21cf074214947d620113c15d330914a2731dcd479b5c0abe60abd62ce878d2e
- MD5 ca9603820cdd63e1d4450193df5183c8
- SHA1 a8041458457a23f5b751e0c65d3f4b11ed7e090b
- SHA512 cc51ba9e38e1afde98ffdc53c70af013c1d29cf48361156858e6dc3ccdba154638488c20f37e3229d6f5614ce3d4f50496f143637214de36d48d609609ce526e
- SSDEEP 192:S2vU3UaHXeGiIhKQJ58KocnOEUQq3Avsoj4ue0z3Ue3GmpBPOw:S2vUEa3eGZKQJ2+Pb0oXRTBPv
- TLSH
  T13582BF6821606421D83B473CA2F3F0D7A111FFAD1D52F9CF71449B9D9EFAB186650E0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  TrialReset/Trial-Reset.exe
- Size 1.2MB
- SHA256 fc645d413a4275ecf77c120865d04b4c935468979e05abb7e5e914071f99ae50
- MD5 2b0f092f8f886829049abbb22e8dd29c
- SHA1 b8f4be082fce185eb8e421e5fe6bd44836862876
- SHA512 d0bf7593028cd5c54fc02d73ce547157496c9c98aebdf33980d5cfc3156fa9a3d9772f8470d9819ff012b7b213da659d4c84bbfab5124108431951636b280a1d
- SSDEEP 12288:gBymX43YOEzSu5H1PpgJFH0lKKrjdRhq4d8PRgl56JTgNLpAtBUWUG5CqVS5CD+t:PmIMtjBqtRIgCxCDQdctM
- TLSH
  T121458226E710B119F05780B63928DA6BB4593D760290AC5BF7825F5A74B02EBF4F0B1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  TrialReset/src/FRMAdd.frm
- Size 3KB
- SHA256 c6dd7f0186f8799c676a4c438da896ef9ad8e235614bcaa54b9c8f8992a5df2a
- MD5 fe8c9a3990bebbf576dc2627900c7526
- SHA1 6426de3cd67916845c8e91638ffde4b078c6f98d
- SHA512 725bed8bbdadfd7a7a9945748eeee2a5d566561a18809af5f4a05987d3cad987f9a04859ef74270f3aa14f2432edbcbf92c55784d148e23d0d48282420e1b33c
- TLSH
  T15081AD44A6C697309433C520AC6B7A09F8D525638C472C74774DD8D80FFAB7A92FC3A5
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  TrialReset/src/FRMMain.frm
- Size 80KB
- SHA256 c82712a5e400707f6d537f8bf6bb112c32ce8070d2fa8145f3b67e4bad4d02a7
- MD5 1523cb5c91c3886aff3342f2b1ec3792
- SHA1 dbde1a8735eed5e7dbfe4a0b807f4e36b188d56f
- SHA512 82144d6309d83eec2815042ead2def5aab0ff55952f1b757cb2f5cf6364a7cd34aaf0a9b00f212079e3ff1c4f25570c62fb1da401f509951633e1f769ffe6dfc
- SSDEEP 1536:VmIyJjRTrjYJ7TK1PRgj9lBaJg7qs5dItiXoLzB/Tf:GjRTrjYJ7TKgj9lBaJgX5KLzB/Tf
- TLSH
  T179838407BA42553061F681686D66680BFA64461B64E37C81754F51CC8FB82FBE2F83FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  TrialReset/src/FRMProtect.frm
- Size 5KB
- SHA256 c44e428f60f6aa70f45ad0037fda505af21550093c801550c5f6e1e0af7f2607
- MD5 0775722e1e1345adb802df714b9ab13f
- SHA1 f95ac9a578a0ec51b53408d1885793b59bb1be31
- SHA512 5d22fd4fa58f7fe48d3f9f72fe124d9fda47e1ea223b8f5129cba1cd7594ae14a89804d04b3114f5cd9e51db1b33948798178aa00dca4a576065936f584e2fd7
- SSDEEP 96:tcA0H/VHD9yiH/F0H/CH/2H/GH/AuH/VH/uRHCIw1qNaJajOYvYNSQDNAFvtMI+N:+t/v/o/g/U/k/1/V/uXonJWiNxNA5CNP
- TLSH
  T190B122426A837634247B41A0EDE3BE1DF925113354963C41B28EA4CC9FF0B76B2F9799
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  TrialReset/src/FRMSTClear.frm
- Size 5KB
- SHA256 4c68916461418301eb7ad87f355f73fa36e3c9b1d77580412e5ec9c63dba47c0
- MD5 f83c29ed98736318b54b7f392c7bbba0
- SHA1 fb16abc87f831e24e2be7a5508ed8fe11b4794a1
- SHA512 51d9f27a3504f43abbf2ee144ff998025c94d9f6094d1b96d56f57eda1d45c40ea779357a85423d1c5c471f0c7cb7112fa691c83affe1c1b87fee79c3e5d9958
- SSDEEP 96:tcWxH/VHD9yiH/b0H/CH/2H/GH/AuH/VH/uRHCIw1qN4J2cOFvYNSEzoNj5MIBNJ:+I/v/+/g/U/k/1/V/uXotJR7NsN9Nc/M
- TLSH
  T15EC165426B826634207B8124ACE3791EF965652360877C80768E94DD9FF0777B3FD3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Accesses Microsoft Outlook profiles

Checks installed software on the system

Checks installed software on the system

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32