23467cf1f9d10a5e57b57781039713c1ac22aa5c259e362723d69da4f0d805fb

Sharing

Copy URL Twitter E-mail

General

Target
23467cf1f9d10a5e57b57781039713c1ac22aa5c259e362723d69da4f0d805fb.zip
Size 9.0MB
Sample260706-whe2dsew6m
SHA256 23467cf1f9d10a5e57b57781039713c1ac22aa5c259e362723d69da4f0d805fb
MD5 af078ae85d1fc06da045cffe249c0f07
SHA1 e25f95b302c067dfae94306482914962ee05674b
SHA512 6acc72b053e1e7ff6077189f0a6716a3b9ef0f788acc72498bbd05f070fc78b974a03cee389209b8d72735515b49f1860d8c0a57f96592233d6d000f572b089d
SSDEEP 196608:6RU1xWJvwSkSINuMHmnexXFwbALHfqJzkw1WIbAvgxeB+c9:bgwSkSnMWexXFYATyzk4aEE+c9
TLSH
T18096333281733CE3C8C1F77F35AE9121A29D62CA16ADA7425C0427E4109EFF96EC55E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  PCL-2.13.0.1/.github/workflows/build.yml
- Size 2KB
- SHA256 af7e0385b0772300d6a68f4de98558a2cf981127ef44f5f5321a663b8820a3e5
- MD5 f2f46576ab8df38bd2957d20957b1340
- SHA1 39b7b701c7dfdf2fe78b4e811365332965bb0a95
- SHA512 e36fd4a7e8bd23c4d6bb3f4a17d47163c414531a2cb29cee40a09171c1d1e537601135e96ecc779984f358fa77d7300f0d5226db314421fba797ef2c1c0917a3
- TLSH
  T12F512E92E552287346A04F2FA2E92531157CA34B862C887879BD02514FDE3FE0FE47F2
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  PCL-2.13.0.1/PCLCS/Java.cs
- Size 13KB
- SHA256 ef53b38d8aa57fdc9415886fa1d0a44003c7ef28aea36fa425306f10544b1810
- MD5 973aa844c3dd8fb9b15ba217259eb55f
- SHA1 0e696ee001f58d8d19ec38550bde9b906b2d33d5
- SHA512 ddfae424144cc58d6dc6471f52f8611d422a24cc124ef28d65104011b349d04404e85a316d18d0fb73fe9a9524f9daf377b0ddbb65a23e32b5ee61d3aa64b908
- SSDEEP 192:nukCnbE/pMwvr3CleuwqtQBftTcm8Dap/BdoOedbGCtMpPXlU6ae6a2LKq5BXWl0:NIaMszWQB3BdoOdpPXW6ae3N0BXhx
- TLSH
  T1ED52D5D792739C742887B282278A2A8537F0C957D16AC821314EDF06AF0DDF507F5EA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  PCL-2.13.0.1/PCLCS/Resource/WikiEntry.cs
- Size 3KB
- SHA256 0a7852ae1d9e4b57b848b3f0f6736e43bbae93cd54e82e0d9e97f63749e7b131
- MD5 8f4c12672560b1a860e48782bc43ab28
- SHA1 9d61d810ecdc83f4f307b57f03d12b9a6ce6a251
- SHA512 10bea8ea12808cd9df5c8bbd5931dc17fcc175023b49b85f78b26e3eb7c3b2e4d0027feba2818f4c5a9e94267ac2de3c5869f7ce7c563373c3e4edfec7b4a82a
- TLSH
  T1B96153C565B6A6BA0D32429943DA60C15A715053D812EC35BEAEA3514FB7C2330ECEFF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  PCL-2.13.0.1/Plain Craft Launcher 2/Application.xaml.vb
- Size 16KB
- SHA256 546fe051260b6562b1ed909ee794edb97996ca40f0b4b30d1285fc3311f689d2
- MD5 654d1ab938799a294b70f0f6b64d52f3
- SHA1 502f93a944ce52c03d4a42a7bff7f63878cd54a9
- SHA512 db0e34a4786ee95afcacbf9b791256661d4ef0a71e240ce6e1f024cde62663d2e6fa82b6e23c729e33d5fb3a22c22eacde3dc7feaa84b265a23527ae0321333e
- SSDEEP 384:r/mfSV2CMDQTDvwQvntQXDhqGIupNgYNgceVi53HsqJh/43GrT:mSV2CPTDI8ghqG3pNgYNgc4i53piGT
- TLSH
  T1F07209F73D5A1135039B1851691CA3802BAA4A2B8819B878F5CC85846FDC7BD92F477B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  PCL-2.13.0.1/Plain Craft Launcher 2/Controls/Behaviors/ClipboardInterceptor.vb
- Size 8KB
- SHA256 8928ab38362e291fde3a7e5a40aea5b3f82deba54c1c2f04a089fd85f5455ba9
- MD5 d28d3a76b6087fc265b28170e6495f3e
- SHA1 1cf9bc5539af0db571ae13523ee4dbff41fe7a00
- SHA512 e712c25225aa12c1bf7c7c961ceedf17c468d07ac93ed47feb83868f28360f712efefe0441a030b1d790ff124c360239d938dc770027bb77ff189e6bb032c09d
- SSDEEP 96:pKdhabl8WjQJ/MlMRarScpMc1McDMM8zM8vM8VMjH0v0ktRkM1rDGJr4oq:pKdgbKWcJEWRarERvuzZgM0RkMQJsr
- TLSH
  T189023037B59B37BA839744C95D97E1A29AE7443B084D2535B68C688C4FB02F4207F37A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  PCL-2.13.0.1/Plain Craft Launcher 2/Controls/Behaviors/LazyLoadBehavior.vb
- Size 1KB
- SHA256 cf98848cd5188aaa5dd7def167c954350d6b32899ccfe4743dab841b4d949b53
- MD5 d9a7f56147b40730ca411dbf5166b8f0
- SHA1 9bae2a774a6b9ac2fa8617c00c441becc2d7b7c0
- SHA512 a6c7cda45f4f7758a8a851f59b68b25306b1b1a4e64ad243df204abc5e091ea5343f2fe49aa7ac1f5f252384541681a6a9ee8e488c02b0e8921e5aadb2b00e76
- TLSH
  T1F541CC2DF10735390ACB18AE989F6015B5C0980B419F9449B64C2B984FB2AF082EDB7E
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  PCL-2.13.0.1/Plain Craft Launcher 2/Controls/MyCard.vb
- Size 19KB
- SHA256 603786ea1125d7a907b679964b163059a4849466322e8c318e019679c0439797
- MD5 759919478ddd5220d7494a9a50427e9e
- SHA1 3e2f40c5fdf249723bca6709748064154e10b265
- SHA512 7dd6dae922f264d13fce90b376357f07c2431dc4547b884f184e7ba2ef6e55e5ef3bb2ca173b721d4486dff1efcd892652e59f333cb72f7426a4203239a476a4
- SSDEEP 384:e4n3bTOZyeFto8f1TkCMzOLUhcBkDulNf1vxaHyMWvWaF4eI4ihJLt6DiAjP87/1:eo01TkvOLUZulNf1vASFhF4eFKHv7/1
- TLSH
  T19592B91FB3B957308BEF90AE5E6EA912AD985417443D0432B74C718C0FF12B9A16673B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  PCL-2.13.0.1/Plain Craft Launcher 2/Controls/MyCheckBox.xaml.vb
- Size 10KB
- SHA256 46bb7b544c537b2980759675f1ef818720c21291acc9030e32737e79f27f612e
- MD5 038f5191cc0720d7800e9a89eb57c954
- SHA1 89563bdea554db824e443bc9a3e3c2dea99a87dc
- SHA512 5f88669678acffa9bd097b6aade3e9b0d196b13985b2bf570741f47ab0615d9679279c14d814eaa16fc405be9097847f741c6d2a03c0337ceaa00fc0aa7c643b
- SSDEEP 192:ZqJG3ULaDDUi1C42OC4zYkzZUnWT+3iC8UKXmkyFJbAJ7:UJ6UWDU7JNqbzZUnWS3ibBXmkyFJEJ7
- TLSH
  T14732759FB5560938337BE0664E843E0B7C25A417433E06B07BAC159C0FC5AAC596FB2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  PCL-2.13.0.1/Plain Craft Launcher 2/Controls/MyComboBox.vb
- Size 6KB
- SHA256 afa79c8028d0847f7b4fb6702ba5c4f2334e759eba8fe2c2fe84de82bd5d4bbd
- MD5 3ceb86057b70500c06f86425ee66200e
- SHA1 b61eb2df19110a6c5ff1ece1c6e8e921234aab5d
- SHA512 836d8333ab30096f2abd0df8d539aa3e00ce970b197713aec7e1b0d7750d25399ec8f04ed6bc53c8f33058fd124232df0ee368afdd9d1a87174c4d3d8a7ec8e7
- SSDEEP 192:iJEbTGDMG2Kvx+UZvEe0mg3KvJfknadiJ8+W:iJgGDMG2SFdj0mg3KvJfTiJ8+W
- TLSH
  T18EE1357BF58623B4419B9CBD5DAED082ECC610374A1955A0FA4C2ACC1FF03AD92AD317
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  PCL-2.13.0.1/Plain Craft Launcher 2/Controls/MyDropShadow.vb
- Size 15KB
- SHA256 da81166813e37f008f5d68cc4bddd4774d526405efe35db5109897b103aee765
- MD5 3f74f7d3c78418a582c7a035ae9dbe8a
- SHA1 532b49d7b816b69c5acdba36269f30324f93073f
- SHA512 89e36ac4094993dee6efcbd999234799823881dd77e5d9e5e0ea1feb9b8924ed39145aba80e92ab3924c05a46a5a3f16c8d77b548f9914035ae17b2062d4feca
- SSDEEP 384:VLqH5qLvocL+6l6xxKfwgsJm+GLe9KMHVt4mU:45UocJl9ogsJnGLejHVt4mU
- TLSH
  T17972E05E390B247A8B3350FED81D9C986E82142F453688717BEC224AAFE22F09D55777
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  PCL-2.13.0.1/Plain Craft Launcher 2/Controls/MyImage.vb
- Size 6KB
- SHA256 b7ce5b6821caffc5c1dedbd5d203149f000ad988b2208f58b46033c09000c1eb
- MD5 3eee005f3771f4683d1cff6bd266d217
- SHA1 baa2b4a96bc127475db7803122240b55d9f3728b
- SHA512 f626df724afd7ec2b3420549565fdcb4be514c7694330c6b7ab38ffccf60244c0340d0d88186971914b85f7ad09299accad198f51a26afb95bd3647e61fe8b57
- SSDEEP 192:VtquAjk34rwj+cTFtU3kgs4NGO4JCc4JwdojocJTF/sqTiphSe9HFQoSsNu:jquIk34rs03js4Nx4Jj4JQ81zTipYsNu
- TLSH
  T1C9D1B87B3983976C59C99A235B19F162A444082B0E3DA4DCF55C750C8FB539CC12837F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  PCL-2.13.0.1/Plain Craft Launcher 2/Controls/MyListItem.xaml.vb
- Size 29KB
- SHA256 7983570cf7c151fea775636956a1cbc887e8fb9a2af5f8904fea3d763506437b
- MD5 f69112a5a68454cda3d662531318ecaa
- SHA1 9bb4fe4d8e936d00c7c4e5e14b31ffab067f99f4
- SHA512 485088797679b9d13df7cfe5d5804258760edb617c689ffff256568cbdd109b8644369359f6354c9a9571ba583e04501843942d4eac8d8681655e10284c76835
- SSDEEP 768:Qp8L0grek8c1gnSVTH9esNyqDi1lJsKf0jDbf110EzKnrTPTDtccfgCAT+pfczQm:Qp8LlFHHMN1tfef110vNccz5ZQXRm9U
- TLSH
  T159D2966F3A510B3017BBA4A59B9AA8487D544833863D54A5B7CC028C4FF0B2DF1E67B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  PCL-2.13.0.1/Plain Craft Launcher 2/Controls/MyLoading.xaml.vb
- Size 9KB
- SHA256 bcca0523fc5825f1efeab20cc234db28d37adaec3f9004cbd2b8cf74f10531da
- MD5 0dbe7eef58374002dc16992c967bd95d
- SHA1 530b6e2bf0352289a7aa69217e6368adc9ad568b
- SHA512 d1ea3f4c15ea14764404dc2c6459bc551f9c19bfb7d88f4702d65a2813fb371d7c6b4855d550f5fdf6a1d15d680a7d1fc6e3f3343ad9af1fa5c74b6974bc51d5
- SSDEEP 192:hiotn4WLLW4tue4bUWKYLpoDxNlxRLCFFuqWxpO0sT9WV48FXtu74tuK0+4bcuOA:goJ4We4tP4bkYpoDPRLCFSr4014bss7j
- TLSH
  T1D122321B7B426D3CEA6BAC5A5D1FD026AD802C1F1A3E94D4B30C05994FE5398A17D333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  PCL-2.13.0.1/Plain Craft Launcher 2/Controls/MyMenuItem.vb
- Size 2KB
- SHA256 bc18f00eb154c9d1b99369e05e1f7eb4327d4bb530d885078f02bcb4163da03b
- MD5 6b0e8a3f137c3508d252afdd900ce294
- SHA1 84849ce3f3bc4bd5d9b664bcb574ef609517b3d8
- SHA512 16182c19f5ff106110fb951bfb750cb2fbc64a283af45442b4c7ba5a04483192a1f11c1f6976cf2e77554afe2b49624ec03db02e773fabb0ace557c89fa50814
- TLSH
  T11441F1B2BE9303780397BDAE4E7990167D896023063846B0FD5D16E84FD0A9E917A375
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  PCL-2.13.0.1/Plain Craft Launcher 2/Controls/MyMsg/MyMsgInput.xaml.vb
- Size 4KB
- SHA256 2af9b8668a6e0f8efc39ea6dfcacaa5a2b904752a06f54b3739615ce2ad7d32c
- MD5 63f13be4bd7b24d1c847c9d8a38fbcfa
- SHA1 4201196ac95a464e39656d998671c3738b3684ae
- SHA512 10e92e3f0d35af5f5e8560c21a726018f660d4583f1b345f48320f4aab15095b6501328f401f45ae4dfb5747910adaecf5728f7f1eff8342b29b3a3091be3165
- SSDEEP 96:G1V1VHki8RD8GHsHfb2v5NcpBtEy/o7sZGSwaBSWtuTtJX90rAWZlH:G1V1VEiUHMqHy/9GEuTtV+rAKH
- TLSH
  T10A91852D71040B385787E48E2BA9B94AAF8D209B403D5324F09D01570F65FED71FE3A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  PCL-2.13.0.1/Plain Craft Launcher 2/Controls/MyMsg/MyMsgSelect.xaml.vb
- Size 4KB
- SHA256 4c079bc9de42bd3e7e1b6ff53012cf72b7a9751d50d83c1d0a438d8a489b9d69
- MD5 aa0f346a82b487af3af38d182e3a681b
- SHA1 90b0b6c6262475ccf72688e631db0abbc3680afb
- SHA512 a63f53ca90336c6d9c3eacffdeb1ae3b6c538cfa6599feedb4e7d54b78dd50545076f55c959edcbd382e88b9b606d4400bd6ec723af02147781025dba180bd8b
- SSDEEP 96:IHki8hM+lLnD8GHsH6b2v5NcpBt3Bo7sZGSwaBSWtudP9lAZlH:IEi0HMdEGEuVnQH
- TLSH
  T10791852EB5400A38174B684F1BED7D8AEF89241F842D2264F09D055B4FE1FD8B17E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32