201e7fd5329c3bdbce6c1b0576dbcb15248560ff48410fcf815cd0044f234ceb

Sharing

Copy URL Twitter E-mail

General

Target
b735e8aa7c80d4af5aae2e506488caa5.exe
Size 7.9MB
Sample260706-k3sbnscy71
SHA256 201e7fd5329c3bdbce6c1b0576dbcb15248560ff48410fcf815cd0044f234ceb
MD5 b735e8aa7c80d4af5aae2e506488caa5
SHA1 69f38a7c752ffab07041e0166580e42e6c599f24
SHA512 d15147faea69d61f5be84a1aa772f2a1c2088698e07df59e8f380552aa2fd8be6485cb0181fed4cc4cdd943a44580c9a0e37679f07b5e013ac07218bb81da8a7
SSDEEP 196608:lJaLZrqt4XU94RMENGD8xBVU7a0MamXxxi:lJAGIUKRM6pxsajaOxi
TLSH
T1718633636E916D6ADAE40F31B47ACFFDCD1DCAD361104B1FC213E2EEE46009E6902656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  b735e8aa7c80d4af5aae2e506488caa5.exe
- Size 7.9MB
- SHA256 201e7fd5329c3bdbce6c1b0576dbcb15248560ff48410fcf815cd0044f234ceb
- MD5 b735e8aa7c80d4af5aae2e506488caa5
- SHA1 69f38a7c752ffab07041e0166580e42e6c599f24
- SHA512 d15147faea69d61f5be84a1aa772f2a1c2088698e07df59e8f380552aa2fd8be6485cb0181fed4cc4cdd943a44580c9a0e37679f07b5e013ac07218bb81da8a7
- SSDEEP 196608:lJaLZrqt4XU94RMENGD8xBVU7a0MamXxxi:lJAGIUKRM6pxsajaOxi
- TLSH
  T1718633636E916D6ADAE40F31B47ACFFDCD1DCAD361104B1FC213E2EEE46009E6902656
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- MD5 325b008aec81e5aaa57096f05d4212b5
- SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
- TLSH
  T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  $PLUGINSDIR/KillProcDLL.dll
- Size 56KB
- SHA256 ad581fee00cf1ef795c711a46325aba698d08790142dadebdcedfc921f52b7d0
- MD5 76a1c5f2c061516607853969e78fb2d9
- SHA1 983ac3e056ae53c72f2b9ae52214a2e201a868b0
- SHA512 7dc90348c4c14351b45a598a0f0d2703f828ea73f4b296867ef2993906a3f6aabde0a86d9f3aa29ce11c3916fcbb8202e11dd7a12d6605df710351be73b2cc3c
- SSDEEP 768:24v4lAOys9wLZkwLuEjh2dliAjgJD5p2P+4Z6q:n4WOys9mTNjUliAjwNQ+o6
- TLSH
  T19243181878438473E0450839C2D686D25FFF2C1337E7646FEF9605DA4AE1298E5BAAF1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $R0
- Size 909KB
- SHA256 89487994c9832147aa35cba9d82457ddb6119742a95637b75ca86cf45d4e0c8e
- MD5 7c5829ad7b063872d799ebf2f233ec93
- SHA1 8f5a559f06e11cc99c78eac8e7e2b30614f474f0
- SHA512 e3a7b54f5bd1110462488503b291cf2903a751b9c033d94e6200938e727bc3432b3f4b1f3a00f5c6835ee5d8cb79a164ff09ed541ad8995a08b1ba0229cce65f
- SSDEEP 24576:kdVMjtnRR2KnLP3a+pcnlE/JnNJufNFdMh:FVnLCV+tNJufNFdMh
- TLSH
  T19F158D10FBD991B3CB47017345B5971FA236E6862B1069C7F7D42B2FAD222D26D3A20D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8