a456bdbd96bc19ec183dd6c19ee8d4fc4ef246ceab6349413be6e8401757dba3

General

Target
hmcl.zip
Size 21.7MB
Sample260707-ml1b3acz9l
SHA256 a456bdbd96bc19ec183dd6c19ee8d4fc4ef246ceab6349413be6e8401757dba3
MD5 1d9e9f01cd391eef6afe51438e6696a3
SHA1 5c306739ffca265503e68d421e1a6231d03f872c
SHA512 518ddb0cb5bf8b65ba1c768ee5f15422568c49e0b10e5b6c80811f7f6f9ad29c8c39942218c42e1050ac443a2d0c83e66288a71dc957ac4414ee9f29c77e6ed2
SSDEEP 393216:oapVU6u4JevYYgYZQKoaeT7qIa3YANH3ISfXYbt1/OmXUypMPOBgZT/+s:oCSUIkpT7+3YA93IwXYbLOPcYTl
TLSH
T1C1373393DBA0049CA54CDDB74D013750A6368A34E2F8AADFFF41BD701F69BE70A20665
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  hmcl/HMCL-3.13.2.exe
- Size 505KB
- SHA256 8f47d7121ef6532ad9ad9901e44e237f5c30448b752028c58a9d19521414e40d
- MD5 bf3f290275c21bdd3951955c9c3cf32c
- SHA1 9fd00f3bb8a870112dae464f555fcd5e7f9200c0
- SHA512 d2c354ee8b6977d01f23c6d2bb4977812bf653eae25e7a75a7d0a36b588c89fcdbdc2a8087c24d6ff687afebd086d4b7d0c92203ce39691b21dab71eafd1d249
- SSDEEP 3072:Qi6LKKSPluzye9iHWptICTrbusJxDO9insyH6+PJTOramZap5XVeR4zW1mFD1gbH:8UHWDICTmUxDpEa04+GU
- TLSH
  T103B4B05036F4D926F2F32B743ABDE26158BA7E80A934C20D2501665D1BF3B40A96CF77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence privilege_escalation revoked_codesign ransomware
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  hmcl/dsetup.dll
- Size 22.7MB
- SHA256 624c03af1ea8b45cfdab0a515119eb25d11d33d822c1c0e60e7aade2946d7e02
- MD5 292674bab05cfa3ac822c95dbf74feed
- SHA1 7be7a3561ee23b6cb0db0ed03425f1df0b1a563f
- SHA512 0120c298830dc6dceff70a8dcde607fa3ce7729c30c194122ecbce831c98083dcc4ddaf1c32b03534bf488bbbe25a38c662f5ff177279ee9817d43ceacde612d
- SSDEEP 393216:srfoCSkVG/iYKg3EYc2+t7oqeXmil/4cL8u+H1mLLmu7CeIWpzz5pZ2:aQeEI7t74Xmi1/Lj+4vr2jW5z572
- TLSH
  T1FC3723207AD0C426FA771E716E6BE507D53B788C8254A10F2260569C9DF3E846B12FEF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence privilege_escalation revoked_codesign ransomware
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral3 behavioral4
- Target
  hmcl/dsetup_orig.dll
- Size 93KB
- SHA256 2a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f
- MD5 eb701def7d0809e8da765a752ab42be5
- SHA1 7897418f0fae737a3ebe4f7954118d71c6c8b426
- SHA512 6ff8433c0dadc0e87d18f04289ab6f48624c908acbda506708f5e0f3c9522e9316e587e71f568938067ba9f37f96640b793fdfaa580caedc3bf9873dc221271f
- SSDEEP 1536:Bc8tBKv1HCyODN2wjIqlLmqxY3AMVI4I9okOEvc0/c/sZRYltL26VVE2S+JJqsHy:BftQv1iyODswNLmqxY3AMV71Ev54EAxM
- TLSH
  T113937D107694D076D9D620BD718CD7715ABEA6B41F6880CBBB461BDA8C653C0BA3E30F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral5 behavioral6