3a840389103ced587bc229a932a39c4b447312588b5bc38b52d1fd14f73e591b

Sharing

Copy URL Twitter E-mail

General

Target
3a840389103ced587bc229a932a39c4b447312588b5bc38b52d1fd14f73e591b
Size 83KB
Sample260706-mx9d4sh16m
SHA256 3a840389103ced587bc229a932a39c4b447312588b5bc38b52d1fd14f73e591b
MD5 d150e28424be8d43aa0a0ea486a0dce0
SHA1 68ad657cefeeeecf804f71a067b0936398310f1d
SHA512 dfd35d6ded6631893327a0b705e0c7af8a06c5cf7ed93bb962e6922e28950dde0c7452dd6d0ca92749e4326a9cb41aac272999696be9d95e2145a0f473f08d00
SSDEEP 1536:pKonukgNz5nEpL10FdlXrsjzaI5RjUKncX8x99Z4L6bL/nzuyyieE:p5uke5qLiPmaiUKcqJdbLLn
TLSH
T1E683020FE9AAA101FD727F778A9C2221A13E151DE058F0AB66F1795D9A07346878F30D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Network Interfaces.lnk
- Size 2KB
- SHA256 7e1d70790d0a10b73bc71ca8e51f4bafb1e6ecbf7c954700622e1ffea7a5ca37
- MD5 d1d00b7c4283fbf74a8f7d4264aadb64
- SHA1 bb7de95d58135acae5dc3f84f685f9fabc82b2c6
- SHA512 33634ab997822b6854a92abb2e864a6f8448bf07a164b68610e502ae66772ec01d880f2b3ad8ca0f4ae4160d4ea7b9ee16376423545a1eefd54c7bd98e260153
- TLSH
  T1E341FE011FE30736D7968375B9B6A386863AFC39F4060F5D90818B8478B300195A8F7B
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops desktop.ini file(s)
behavioral1 behavioral2
- Target
  OpenVPN/Client.bat
- Size 752B
- SHA256 4dd6eb11dd9e5399c7c84bb602e5147524e891b578a1b90970a8afdea2945d63
- MD5 1080298f735c0348f3b7c8884419227a
- SHA1 58f2a75b8349619537c342ab650fbe8de40e8cbf
- SHA512 49e8303d7ebd437f44d46d60c7e2e407445a8e052bef21977ce77b24f68e394be415fca8d4d1271c44a261752f9ef4c3d5bf0f37665faa1b557661c5abbff498
- TLSH
  T1E001D0052E81AC711A291963C5FDC0589D2DF550D030E86C28D3E0DE097EFD758535E5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  OpenVPN/Server.bat
- Size 757B
- SHA256 95e39ddaaa5da049fda049a3dfa632a94eeb96fffbd4bd396f3f62fac05de8b6
- MD5 ed11737d7197dc49879caf17d5e3fccd
- SHA1 e988e7642d469ee2d22b2d95b1b4937b02870a3f
- SHA512 dafd04fcffbd9a83d710da789f1c76f1823f52f119c73e8bc20439a61714162b5a54bf1873c1dae6071db8374700af59575a69bf4d151a365744d5c8c8e8667e
- TLSH
  T1AF01D0052EC2ACB10A2D196385FCC098AE1DF650D071E8BC24D3A0DE093FFDB69836E5
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  OpenVPN/Server.jse
- Size 357B
- SHA256 7900905a22255175c7ce3e52de9ec4e89eaaa6d44b42ed56ba20a1463cb8dbd2
- MD5 17cd4fc7816e567bb8dd96cbfbc78a6e
- SHA1 12f7be4c04b162d880782672d2164f35707994f8
- SHA512 e9698dc24f45cf5c16add80a838045af4bceaf5d443fe947202481cafbaddae05802b4fcbd4ceb0eed9c8bdb4ae958f16dda311a334a4965c1f4dd56eab312ba
- TLSH
  T1F5E0268C9E5CC952215B8187013BCC4DC3D604546714D4C5E6C6ECCAAAA8B558E77271
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral7 behavioral8
- Target
  OpenVPN/expand.jse
- Size 1KB
- SHA256 19dc0987cc7cdd453a2751b6d1760bcd6ecfc6c7e8c0d7ddd7008303a2ce3edd
- MD5 11d1c5388eec5653fd6f3ae65c693a76
- SHA1 015aaaa7b3582b7a63870a157f43f6d5e179a737
- SHA512 9059307e6cf57556891edc7e8e4f752f59a67d370fe58f71e292a7f41f058159f7695e304734fbb67f6d00bb6e28e258b44895857a237a5a2c6516ceadce476c
- TLSH
  T10021EE141ED9ED43A37312C79FAEE91DD8F80029052CD964482CE28A3880D696DFD6FC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  OpenVPN/scripts/on.jse
- Size 221B
- SHA256 c1f1dc7b188914a57f60458ba7b65b585657b9dc1e5c0995d4b7bf4361a15379
- MD5 80e77485ec457bf9cccb28cae916abea
- SHA1 1ddee8daf921a59af50af2224996bfcc6ef9232d
- SHA512 464ea7a57d43136035e35af5f6538b100d056296417f113c6a0cee3955f4c1b6fc1f5226a02d7840ab4a33a5f50e49a52aa980233a28435af4b74dfa16f1ca81
- TLSH
  T165D022896D48C435992B8287D27BED8CC3820C884200E140BEC2CCCA325DB9ACC6B29C
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral11 behavioral12
- Target
  broadcast.bat
- Size 55B
- SHA256 eb33a704e10547afba9e9b85c74c93cda13f63d9cd23bfd7d19ee317cffae548
- MD5 f510eb5709fc40b8e98ec9f7239dec1c
- SHA1 f002a0bbec165862c7b134c21ccb6206259a037b
- SHA512 26eb30d97aac5b70d738477e0621ab1b4cb23d0ea7463475c2307d829d7549b5547ed0b458617d2b9f9a31264a5a7a8452b0aad95e8f9ace199c0dd9ec019e3b
- TLSH
  T13F900251C87A08355C154840905B359CED0B5247640499C1309151A8945FE8D92590D5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  broadcast.exe
- Size 137KB
- SHA256 416beef38abad11adc99ac3b364f9b402b1941b90e557cbe52ba651adc5e7c5f
- MD5 9e159e839d5d2b22869504bc6d4f07cb
- SHA1 206ba8347e5fc35cc6fb135863e3bb380e4f4465
- SHA512 e309ce54d1f696b60705dcf4bb1bd5596656c8e2a9c7f114411c44aa8f46c6df4ed3cdaf03798b2d53ac549e8c8f42dde77bfd768af89104034f6b35b796a869
- SSDEEP 3072:7rrQumlAZzXBKJxxWDhC777sEe1knUR43jTtvauLcZx9geu76x0:sufzoJxK9EenR9ugXx0
- TLSH
  T1D2D3389535CD8771D57129300460DA60CEEDFBB04B70AEAB63C9167A7EF0680B634B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  install.bat
- Size 940B
- SHA256 3b70a8e581a527ab7274b16602890c31212baa3167a437d982cec4c65c983720
- MD5 74b9fe466c5eb1b42cd13d19c4ffc7c5
- SHA1 87fb5b63d2c894f44a3cef26bb069dd8b4ad8e68
- SHA512 5eb1a167dca2fe3b0eca22f5f6d97e1028dac09c722644a3303769ad5ca4be30a046ab8cab3932acb0888172771ab208d5cafac0e7829c219bf28d519831f6ed
- TLSH
  T1DE113D4956D980A05DA50701ECFFC4BDAE4EC7CF1208ED800453F9DC792AB9909DD2D2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral17 behavioral18
- Target
  uninstall.bat
- Size 290B
- SHA256 9d390ff1eec3fdbc0ae7717714ab0b55712b8fd2e2f3f344d080abc8b503fe35
- MD5 cdff69876259de92fcddfa2c7f6ae141
- SHA1 7ca190a5eb73c119c115635fe9aa0fec69eff486
- SHA512 05e58250bb4f08109e6043641c700be6169fab6803163f9e7b5fd28ccf50c8e0c62a29f18a1a35ccb026705780ef78d5163bdb1b53b10cfc4a0e4acdbc912489
- TLSH
  T1A9D0728288C68022CAB19202A48F09D8FF042383A10C570228C726CCE05FFEC106A8CE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Drops desktop.ini file(s)

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Checks computer location settings

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20