c9b47a1fee13a9bfdca8cda2cdda4b8399dfe3465b012791b4ba266710cf7b7f

Sharing

Copy URL Twitter E-mail

General

Target
Microsoft-Activation-Scripts.zip
Size 533KB
Sample260706-wtyb4sa14z
SHA256 c9b47a1fee13a9bfdca8cda2cdda4b8399dfe3465b012791b4ba266710cf7b7f
MD5 6d132f27c64e7b63f2790647126ca0b6
SHA1 c76ba3ab5acb12ffad4a970c79a2af68b9c807dc
SHA512 2a78d2c30207fb55d50eba729c8069cfb0765339b9878edad747f9b8edb71b5fa861df598e928459a4e20d40e0eb9b3a8509c2d3272e72dd599105e627883831
SSDEEP 12288:nz36oGwoC47BsFbsyoYwvYpk1F2odKFnA1Gf6bRMqHtUXYnRCPh0KZ0Rfl:zKoGwQ72b3oYwvYpQKe1VbRRj60dl
TLSH
T152C423BC7678E055EDF214BAC66EAE2C3E720FFD14880B60500829595E63BD1D6DBC62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  MAS/All-In-One-Version-KL/MAS_AIO.cmd
- Size 744KB
- SHA256 850f979665fb93999acae93f4790c1ff8ed2041532060b7966a121c2d29a0bfa
- MD5 8e0a0b48ad0289d647e55d802170d795
- SHA1 6adced8154ebaa02e06efcb85715d2663c731bd0
- SHA512 58edc773d275dec130cc5ede3c55edc5680f52e1b7ca4d78b349323f6d64b565ba052366b59ff4a94640fb49d14c2ec490dc69946bac9f921cb82bb62bffe563
- SSDEEP 6144:g3IufxkU5/8BcEvTGmFOE8THncQx4Oz0ykw7Auj:g3IuuhcEvTGGOEmcAXz0ykw7x
- TLSH
  T192F41A466D0261A601B3F379DE53814EFB2AC2638375526879ADC044BF36309A2FEF5D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  MAS/Separate-Files-Version/Activators/HWID_Activation.cmd
- Size 81KB
- SHA256 6828dcb2650fffde272b3af4a3c3ce1ca85130fd210232cb1f56c8299693ea2d
- MD5 4595cab256806100ca8c5b84149e147b
- SHA1 8c3f2c89449282be86dd5437d18f1f7a32880001
- SHA512 2b777ba71a802154860fc9133cb3d5afac9269793cc20e9c77e95ca3209cb1370f053cc1bb0eaa92273e1f35bf84c61c522934ec3e89aa99aab19240efb54a2a
- SSDEEP 1536:1X/Aa/73y/DaKPPQVhEE6Zt/flC2nq7Dn6lirvGHIxGrS2cv9f6s:1X/1/O/P/g363HIpH
- TLSH
  T153832B07B50260A602B333B86E675686E31EC6A39371A35C796DC088774A74DF1FB79C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral3 behavioral4
- Target
  MAS/Separate-Files-Version/Activators/Ohook_Activation_AIO.cmd
- Size 163KB
- SHA256 9c77ecce70a4c7161589dbbe20d9282a0b5071dba6260abb59ca35a765f475ef
- MD5 a5d35955dacf2488695e739701e0f929
- SHA1 df89bda877c00fc9c5ee8a1b05baafbe43d340ca
- SHA512 df7e4e3dec433d7b27195d0260b1516cd012a8f51b241cd3c5de244183fc2aab6016511df290ea9a0dc8e756d0d57ed0431efa1552d86c99b454e1d643524d99
- SSDEEP 3072:Vg/m/HZU/Qx5GfeT3HIp2v2xcGmMZgnnwT:Xfx93IjY5Q
- TLSH
  T1ABF32B076E42A1F602B7F379AA57958EE32DC693C330A29D396ED094774630670FE24D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral5 behavioral6
- Target
  MAS/Separate-Files-Version/Activators/Online_KMS_Activation.cmd
- Size 172KB
- SHA256 1d9ff5e5e43b05a1d6b31a5ccbcfcc43ef907ecba015b95ee301e98612cfcf97
- MD5 6a9a84db114ed50b06eeae247113617b
- SHA1 6f56d28520095b6d3a5fc15940fb750cbe1f557a
- SHA512 dec7419333f4e0ef743d7eee9dcbe9f35bbfebda2f19ab65eb107a7f94e059f1d9379cf8727c0a9c66befa2cb4329b5ac362e1a9c77aba9cfb6e3782be8e77a6
- SSDEEP 3072:3ui/m/b/Y/FmUGgDM20t3HIpUGGjYcnck:3zmF3IQnck
- TLSH
  T19B044B47A54260E602F323BDAA569187F72EC2A34331E2AC356EC484BB5631B71F775C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral7 behavioral8
- Target
  MAS/Separate-Files-Version/Activators/TSforge_Activation.cmd
- Size 359KB
- SHA256 23a619c0d64635a25aa64c978476bddc2d66bfaa09fe0fc51fc6e7764e0afbd9
- MD5 704f216ede0d37cd7437de6271859bf2
- SHA1 500341d424b0a0c0fab7abb91a13d9a696c8d745
- SHA512 18fd15019ef235b2d1890cc0ad4b6b722026e40cff7f12e70c8606e419cca0fe01231870e4040eb8559a5d7d35d69c324aba735b05a54fe4173a68c6622deb3d
- SSDEEP 3072:D3/O/y/x/7/k2env0yf3/nNq/Q/3/O/3/UGs313HIp0Zl0FcExVTGX2THiwPr8rN:CA/k3IncEvTGmFOE0
- TLSH
  T1E2740945A913A5A705B33379DF42804AFB27C33303755369BAADC104AF7A309A2B5F6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral10 behavioral9
- Target
  MAS/Separate-Files-Version/Change_Office_Edition.cmd
- Size 56KB
- SHA256 4b7e5856c90a5cf90cd0e689d79ac476b76db0a755a8bc00fc3cb260bff9b024
- MD5 4ba61114ed2e18ba342171f20bd1fad7
- SHA1 1a3317037997c06992cda7679c0d6759a1b41e3a
- SHA512 e34444e4c8272a6581380b2f21d6b920e32753b38c3140395a1bc604841fb318f03d6accd849b3900830ee1c8dec98f51ba89e6980cd1407a1c3a465a15ad953
- SSDEEP 1536:N1/Da/O2y/t/Y/H/R6/Qd7p/S/LuXr7/N/0/Bp228:N1/+/k/t/Y/H/Y/O7p/S/LuXr7/N/0/c
- TLSH
  T115430957B94260A602A732BDD5A7914EF76DC2A3C32197DC386EC088B716354B0FDB68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral11 behavioral12
- Target
  MAS/Separate-Files-Version/Change_Windows_Edition.cmd
- Size 49KB
- SHA256 2e3d1ab1ec9120b199578bfa144106e8fadaa6b9c7fba40d3bcc6c341532bfca
- MD5 4a06062f085ef7951684f62f59e4aa94
- SHA1 121e9ddf48afb5a47192d3c6d58f4dbc70c13955
- SHA512 620baf4d951c4ccab9db7558ffe271752336af00ccf389015a4c83a920934bf5c9823d6d4d4f322754c95f6c8b969dc24f9acfa1ae2b2e1e49200f0b30ead44a
- SSDEEP 1536:2m/Aa/lp21d1/BX/rA/cz0ykWy2a+Rnu34W/y:2m/1/Gd1/BX/rA/cz0ykLO5sy
- TLSH
  T19C333B97750251A402F33275A56B828AF72EC1F3A720974C785DC0A8776B355F0BBEAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral13 behavioral14
- Target
  MAS/Separate-Files-Version/Check_Activation_Status.cmd
- Size 47KB
- SHA256 6df2937385386d0c9682d351797e674583a410f4792bb7be45302f40ab90287e
- MD5 9acfe49b336529b1a7451a38daca8135
- SHA1 f0e32a16232ad71e0fc32aeacb3408b0b6b1b2db
- SHA512 f348217daa2d5a4793558dbb3ae20bfab00cacb9c0d5767a39085c71c238cdc7347498cc5b4f86ef801552cc1323557957615664a694c330597813ea6e9abe4d
- SSDEEP 384:TT51DLGNV1caT1UwZoio081ReKVwlfaNodso0XTf9rcKbVKQKUKypLw8wcH3L+rg:TTO1c2o9eyPvpnga+BnJbYTf4Jxm
- TLSH
  T15323E905FD1B926B5BC733926E72C68D6C7482EB06FE54A878CCC884F124F6893F9549
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  MAS/Separate-Files-Version/Extract_OEM_Folder.cmd
- Size 24KB
- SHA256 3463dac23a542bb6e3b8e689b282495bd0f791a7a256d3cfd69d45242a1c5469
- MD5 12e214d9068a74a7eb9175ce4066c046
- SHA1 cc236253c59e5f454304aa4845604ae1cd8e2227
- SHA512 afc6f28371246cfe6aa16f0c1d7d6723c338dab38bafe05e4d7688fec20e5782732c6549bfd9ab043e29fb7fdbea9f0a314efbcb66228de3f8e3ad8a3775dadc
- SSDEEP 384:DeJsOd3PBFhbnJcT/BFLGIS0SCHx3kbbxtUYnv1cwY:DSdfBFRnJcT/BFrS66v1cwY
- TLSH
  T1A0B2A4D72D06A06281B737BB4A37914EF72DC1A3D310BACDB49D4478B34A38DD4A91AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  MAS/Separate-Files-Version/Troubleshoot.cmd
- Size 58KB
- SHA256 aedff86fb47c06c30e5c487700d7e3effedc3094686bb30334597ed7e49c6ac2
- MD5 99c9bd0bd5b763a3695854fc222ece61
- SHA1 730fe77fb169e81e2f7885af5658acdabca32501
- SHA512 03a39cf95b82551ba420bab336ef50aecd0c3ac151a8f887aeb758925d1eca5c6de8b2ef4adb4f97cdafd6ab198b606f76cdfdd53a6d8577066359081a2fd77b
- SSDEEP 768:DSniBFpnNI/rBFXS6MOgXL9DlVhIQ++iW3AaPhPa01SAuXmPGnI1jzsWpjE50tUf:+i/pa/5MOgbHkQHiW3AC/te0c2G
- TLSH
  T1C843F813B60190B182F233B9DE37964EB71EC157D324AA8C759EC158775538AE0BA3EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral19 behavioral20
- Target
  MAS/Separate-Files-Version/_ReadMe.html
- Size 84B
- SHA256 8932bacd828c0716b136af6aa15011aed0015e7838006f2cff7a64954a5696b0
- MD5 574e18c1f9b32a47f988ac91588901ba
- SHA1 4c0827e3deeb84cf442e0356dfc1883bcb131fbb
- SHA512 4c480c530af4218e5ac276228a372fcd799912eb183685f805b6c47b5d6971be42a4dca2baa016425dc2499367624cb70de12d280ddcb7b613001460dbf820f8
- TLSH
  T1CCA012D296101C07533225B06CDE200641134C0179445020C1C0389B04B4F04CC83331
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22