9c545a317839d66b308c4aa79331ff80145db49ba894af216fc2381525436f8c

Sharing

Copy URL Twitter E-mail

General

Target
9c545a317839d66b308c4aa79331ff80145db49ba894af216fc2381525436f8c
Size 1.1MB
Sample260706-j8tk9acs6v
SHA256 9c545a317839d66b308c4aa79331ff80145db49ba894af216fc2381525436f8c
MD5 ab74f1e459bc0ced5fdb04f3a4964580
SHA1 82fa8374f92127aa0f080d3b73dbf7e56a11d270
SHA512 2e79d24d9189b4bef8edfe5830443117f11c832ea0d7b8df1230d4af6b290c9f768fca8105e774d1ea3770681fc5e2fc315bb6797c6596033df7e0b03aba1343
SSDEEP 24576:g0a4AEkzC1SsJfI9kIBGfd0nxbSaLZE9/Yzb//RYdjwa97BdRFf1kLHlF:gGyzC1SsJ/q/ZE9/Yzz65n9NdRFf1qlF
TLSH
T1BA3533548AD49013E86A05304CF1A939B2F91722E1D84E0B3E59F91B7B923C77B1E7BD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  9c545a317839d66b308c4aa79331ff80145db49ba894af216fc2381525436f8c
- Size 1.1MB
- SHA256 9c545a317839d66b308c4aa79331ff80145db49ba894af216fc2381525436f8c
- MD5 ab74f1e459bc0ced5fdb04f3a4964580
- SHA1 82fa8374f92127aa0f080d3b73dbf7e56a11d270
- SHA512 2e79d24d9189b4bef8edfe5830443117f11c832ea0d7b8df1230d4af6b290c9f768fca8105e774d1ea3770681fc5e2fc315bb6797c6596033df7e0b03aba1343
- SSDEEP 24576:g0a4AEkzC1SsJfI9kIBGfd0nxbSaLZE9/Yzb//RYdjwa97BdRFf1kLHlF:gGyzC1SsJ/q/ZE9/Yzz65n9NdRFf1qlF
- TLSH
  T1BA3533548AD49013E86A05304CF1A939B2F91722E1D84E0B3E59F91B7B923C77B1E7BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  $TEMP/Allow.xltx
- Size 91KB
- SHA256 d6ad5df6939d9bf09bf87ebd76d6954a7a4ce58d79aad360244119ccbb4f7159
- MD5 0d7bbd51b70783d4cd6afcb98cc6d2bb
- SHA1 4dd79426b0d283eb9a2ee868a939ffc70945c550
- SHA512 f661b6f871875f06518ba5cc841e3d23c305219b12ab112444f6599d486c956d16ba88f3791d85ec7336ddd5ab3e258e782c748e1d6062d1e0e9b895ae002a24
- SSDEEP 1536:BF3+dK80zVt+tufbRrQN993EjUs7D8XVQPEehSD2Ved+LYisaeKN2hzC2C7p65dK:7PXFfb2z4N7D8XVQPEeR4LiVHWm7uBMb
- TLSH
  T16A9312EB6396BD502CC3245B8D7152E1C71A9925C2E2BD3C72A5A33305325A427F7DCB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  $TEMP/Broadband.xltx
- Size 64KB
- SHA256 55f4c66d426ddbba57c4387f57d85da6bf8efd21e82a060384d82974a5e92496
- MD5 178926b00f9a29d17edc7f2d14ee9508
- SHA1 c2e5dc10d6b3e1db03bfdf7df2cb5f3430e5029d
- SHA512 e1a42ca00d6da1793ac7b1997d88f2422a2109026c040afb605a81c28a6b5ed3a4bb614eb85c2ebd931118fd8b98a2af382ba647b26e132373058b82edf5143f
- SSDEEP 1536:xhESpHG0RcbY0HGBEAdJ0TsNPlx63+/+zMEA7ShmB//MF/5:xiSpm0RcxHYEee4NPlx6Q+zMdSmFkX
- TLSH
  T1645312CE7EE5062CEBD32B1CEA6CC78D924D4408D259B8B4D670E730A6C4DB5057F952
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  $TEMP/Cameras.xltx
- Size 96KB
- SHA256 f53c0d61cc7361435661bbdf81eda24a2a3db9e810c7e21b4d676f52cb5e17fd
- MD5 4fc758a70d86a7eb641af3c820393caf
- SHA1 b5ecfc03bcd6583161c01eb64c5554ab67f8181f
- SHA512 7edd0c002846ca04bd939e1b2fb7b31de31f7ea058c6f931083290518a7633a7f9c1c5e9282228944129832eee12c4735bdaf0cfbc828819b738a3b2e3e75a39
- SSDEEP 1536:QYkiOgnCQ4rsbzfUJxLSjJG23/k+RIArk8MzHIPDtPujeJv/K8L1R:XkiHKsX8JS38+RxrkP/6Jv/3
- TLSH
  T1C7A312781AD4BBF5CEFA1C845B8F5607F8D6F32554F01B900E1AEB660DE81172278D45
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  $TEMP/Dod.xltx
- Size 24KB
- SHA256 11c40d19b42d7554c540c1bba7c9a3830d94141d002a38ce083880c0dbe126a1
- MD5 c97d7492a4d381d598ab55f7189ed3d2
- SHA1 ddcdd99c8d6c2e29bdd7b8402c522be1ad7dfeab
- SHA512 2da04f2684b51df7088364038bfec7e8887ef1476991a8227c3f1bce17c7fde6473e206be9d9f6496feb9e6ef93f52e45f2027e3d94940df9cfbe2fa1b2cf486
- SSDEEP 384:deKAaKUcx9TMkHz+inLyJVC5xyX0CZDLeYZBNYLtFmdJzC7/YcqOiogksZryy9/I:d3K9x9okT+CGAORLeYBN7Ogn5hZl9sT
- TLSH
  T108B2F1F796AC01246931DE5CC79ABAA7448C68138772E10AF7AC41904FF2BA4A5DCCDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  $TEMP/Overcome.xltx
- Size 59KB
- SHA256 d7b5aee8895aaaca47d1bd619614c93cd1d9f67813887851fb5e537bf7a33e53
- MD5 1440fc5fbfac7c986d6d7fcc87b445f7
- SHA1 7688e3eaed0357b19e828ed4e229155a7570db3e
- SHA512 49fd54df08b6be483f4d32a8ab08c08627c13450f6e879ae91911ab2f53cba2c535c61d9552a647668e6c142dd6bb2e836f724b988984f9f863cda1029d28c60
- SSDEEP 1536:Awu+Pp/aIO32TloEArpA6FA1w3AKaIrSKSl17CgLiU6VD9qZk:AJeaX2TloptGwQASVl1GYUEG
- TLSH
  T1E1430281BB0546C912AF39AF002BA5EE157AF215722619F39F1061F81FC1B5B4E9DEC1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  $TEMP/Peer.xltx
- Size 81KB
- SHA256 a88fa36caa976feeefaf43ccdfe6f9c4de8ca8ba5ff0632d78d4c4be6b5ac2ab
- MD5 9a71446bd659ccfe8fbd6b3c54233d99
- SHA1 c200b4eb07e0df806fee5568862d869287c014c2
- SHA512 101253a20e916970480ccfa811331486ee48e59d9070a84c49fbb818ceb6225be66996bea4c6c2b8a88c949d69024a44aa2d680bf8a5c1439edd90cd99e12c24
- SSDEEP 1536:ja/4CgKxB+R7nnRWyFsDNUYxVqLiS1cSXy1pLt0ZlaKqylabJEOJFXbabaa:jNmQJAxZNViiyaKqvbJbra5
- TLSH
  T1E98302E43C37497B75247022A38E66B5DE6B4DE3BE0C0B34879604DA1A9D732C2926F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  $TEMP/Rally.xltx
- Size 10KB
- SHA256 8130d6cf8895f7d4638a40470ea2e4847b0dc735b4594a880e5242e70c633763
- MD5 d85fb21fe1eb0f9b57f742bc169aae7f
- SHA1 b4201dc7c0fa9bd4117efdad822328b275b27909
- SHA512 e844848d625c4ae59f53ef37c52f7e64d2fdf519f39c7f539c9c1059053e20ff899421f701797b70be09780332973ae2142613cf7e36283252a3320dd2f63d1c
- SSDEEP 192:KjSZFEp9LiMxf47UpWvp3eMp2Jr90VDh4q5QB/ap2733fCrCmuvRwh3:2SZFeFx4Up4FNAJMI/ape33fg2q3
- TLSH
  T129221AFDA34A2702A6CBA2D75AD2ED867036C2506726A1645CFF47CC474989C077D83F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  $TEMP/Vs.xltx
- Size 92KB
- SHA256 d7202d99c228c879e7ba80649e2a27c755b8d9efa8300ee394e17ec9c7c9fee7
- MD5 a99c834033e2fe31a0b938ecb0bdcedf
- SHA1 61617b0082274aa032f61653f31cee80b2733a40
- SHA512 4a96b6ce2e4b3d6a27b50d0a4af3c1e8a04c8b6b46e3b7f13cb56caec7bdfff9da903bd05b97ba27578804152ba1bfd2ef7b1efa8b07cd48922c38105ab01964
- SSDEEP 1536:WsQI/BiajfXuycnGy24zA7M56BCja4X8w0GVB8VSmUZN/sLqDT0I3s+MscwVkj9T:WcBiyfeygkM5i42KMSmYsLQ3srsrkj9T
- TLSH
  T122931203ED9A105953D525D5D299926CA0E0A3B315CF320BBEB83CDF295FD82E051EF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Checks computer location settings

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18