6dd53aa781f220df12064aaa92efbb553e0697ea2f92f252a20c7a6f47ea5c43

Sharing

Copy URL Twitter E-mail

General

Target
SETUP.zip
Size 20.3MB
Sample260707-sp9b2af17w
SHA256 6dd53aa781f220df12064aaa92efbb553e0697ea2f92f252a20c7a6f47ea5c43
MD5 2c7bb83f8f24aac60141f8e1b8671e38
SHA1 29151a35080e56c07ec483b2d589dc081fed9968
SHA512 486885d8396fd584379230fed15d97d693c558239411693c92988f7efd09f05df301fef92c1eda533d2752c64e6319b9cb3e280526011d567583b74dcc9cc9ba
SSDEEP 393216:eZ1Mqq+g+jRYQ3ctO1D8FPEB++awqn9OM6XGAF4hHKxJfxA3D:4q/0x3ctOwMU+aww9OM6XGAFFPmT
TLSH
T108272266681D3821F4DDCFFC588939EF83A32DAB6E122A996D536635F8173907CC0D81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  DLL/ENSF.dll
- Size 408KB
- SHA256 34cd3f4ebb3ccefc530c081e5c836ecd44be1b2bd0f9ec04d86729b8f3f8852a
- MD5 ec2b9ee490324c20562deb4552237061
- SHA1 fb9d7cc41e1ac3c55d64517468ffced58e0322aa
- SHA512 f3bd42fd14efcad563883f2bc755c47ad7e08db879b9c7605278def6c218f596fe6fde3fcde3f0528ea61e5e6ceaea7686d4577d1a2dd3050692e6d618c2dcb8
- SSDEEP 6144:M7tZ4Dlv9czPei2/IurdGhm2MgKQEjTsdNRfSy0hmRFgcPbA/O8subAiH7eO:M5Z4Dlv9QN+JxGhm2MgKQEEdNR6yJu
- TLSH
  T1FA945D11A291C035ECBB01B18D7A92B95639FD70073964C7E3C4DA7F2E61AE26E31763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  DLL/ENSTRMAPI.dll
- Size 2.6MB
- SHA256 ef4f97e1ba4224abfb7e6e41f14256e2dbb611d25a652dc7031afda73e13ab9c
- MD5 ab7046f0a6100335bdbfaf4923df0d09
- SHA1 cf113ecac3d82557aa1c604e7ebbacb960dc553c
- SHA512 b3bd1b0c6497adbeba6a5b606f6205440820d4a6e55b48dc4e5fbe49568fb963c9ea1c8fdbdd82cb76daca40f96a770ea59eef0c1b4b23b01ab29efe1ef60b3f
- SSDEEP 49152:K698NqkPci1nojSCrJEfs+PhzZ3p0TTT5WzfJ5ProZx4LbDuOZRwq/Rf:58N3uTTT5WzfD
- TLSH
  T12FC55C987F9DC071EA4F527420B9BB4DA65A638827308DC3E258B95FAD711C02D379CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  DLL/ENWLS.exe
- Size 86KB
- SHA256 4110541eb9a4ed5a468cca11909a4e2c4c378c30cdaeac08b8223ef30497f411
- MD5 eeefcc6a6197bf81a9a147aefca6af40
- SHA1 d9e27673f870a4d8e72ae634a9793bc4471e0c33
- SHA512 92c10d613d64a812ebae255d5462732addc7695b4a375c62e33cdda6a40f4f1134c545deb9ab8366e4650a2dcbf782efbe535646ae22f84de3f12c5e13fc0d85
- SSDEEP 1536:+8r2zxCpilgEMLqxvfzGzw4WLCuk7+IusL:wvww480+IusL
- TLSH
  T12E836B067893C0B3E4064831C989C6C56B7E7D137FB6949BFB98035B6EE12C42B366B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  DLL/ES2Diag.dll
- Size 255KB
- SHA256 4a47734a0862564814bcbf1eb1b09f13cd00d01e1a8d0c877aab3061ff667754
- MD5 0bd50f61a0174e6527fb52a26c329ad4
- SHA1 2500c4b8b2dc25e07a2c6f665ff556d8a96ca994
- SHA512 2188e8067b9cd629a3a330e94bf8ebd8c603406f93c8bdfc24c13cf37ae27bee8ba6c713634e526f7f48221eb27f7395c7be9abbf85cd4a8f08f9d61c1808649
- SSDEEP 6144:538xU9bWiERLbO8cfXnbDrfNLr8uhtX+oqRuOoMWW:538xWWi6LbO8cfXbDrVn8uhMP
- TLSH
  T177444B61BA15C63ED9DF13F1A9BEAB9D2468A8910F28C1C7E38D9F5D4D226C31D32113
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
behavioral7 behavioral8
- Target
  DLL/E_JTACSV.exe
- Size 257KB
- SHA256 6e4188dd4fd3a5e1ae016bdeafa0f61b7f219acf6965ec5a2d53a8caf52f2b45
- MD5 dfa0e84afa5fcd380c384abc1ecd4c4b
- SHA1 84276e77683726ab4fe17b59a263cd386e51553e
- SHA512 ab558d9cf22fa876403480ba94aaf0b22f575537f63886bbfd674ed70cfdbf6b39316795d7dda18589587b98f179d76a8986692d91aed8da97f1587ef8719cf8
- SSDEEP 6144:XnAR9sX3wJpcTH/6k+c5E0o4MGv0fvQreGMS:O9lSR5vlMS03QreGMS
- TLSH
  T18B445B2077D48835F8B326B6857DB26447BBB4301B30C2CF679506B95A72ED19E38B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  DLL/E_PRLGR7.dll
- Size 100KB
- SHA256 ea650215af1d90d83c4bbfebe814926d8ddb4ffb9797be83b93bef35b2bbabd4
- MD5 2ee89b932e4c0a7f503dd349d587630b
- SHA1 159ecabf22e39588350ec8785dddf0936385ae8e
- SHA512 c6113f1a991e53b6b765dd6d93a55dc51ec2d5b4f317e0bb92002240e217cac1c10afd02b9b5b561e68b822de93fe227db6b2d104967e99ba6b7e24dfd8acb70
- SSDEEP 1536:Ns6t3wZBy373C6x8qVkXdVDPmbsfc0ahz/s26YmJsG/ymch:Ns4Mm8YkHDPmoUo/ymch
- TLSH
  T1B9A35B213690C135C8D631BC56DCAB3163BEA4700BB485CB7BA917EDD9A07C1AB3539B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  DLL/E_UPWJ01.dll
- Size 988KB
- SHA256 4fef4ff8e72422e355843f0a8dcb82064a88f94ef1c26917f6ccadc31fbd345d
- MD5 5799f3f4c0345d40c1e277c4413b8b16
- SHA1 c5baec0d277091fe6e291d39c7e3b81c9b6828c5
- SHA512 116d91d1c6862143e7acf4f2977f79c2d43b4beef502c6080b2c0a7c09a996dbd9c860fe0de33b8a97f24ff3f5fc440d7d23c3e03de25c49cbb826de6cd55416
- SSDEEP 12288:mePu0/A4T7orAjG704Bo8Mg52vuZJrN+B0clhmAm4ChHAJWTGImmnc:mUogDgUWZD+BlAAmBhHAYThnc
- TLSH
  T166257D202FDCC535D3AD2533A57AA37532AB76311B3092CB6A902A7D9E305D3B938717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  DLL/E_WTACSV.exe
- Size 286KB
- SHA256 6821f8db3b5a133bd4629df8cecf045b966e0c58731fa31901d6668096075259
- MD5 a97ce61ec9370a2d7e369b3773579d61
- SHA1 ff5f9f0253388725710b950b15d8c9d4c0d19507
- SHA512 9e11a98a79ff154f777632948955451fae7f2fed8c03095acba529cbbad0a4794c44d1c10af9f1427e2a552356713b20597d6b05c78b90e6636066495717676a
- SSDEEP 6144:L+rD0IWzzMe+sfD/SEftFo9+Fl3+qqkSAonJGzvOOu0MYn:6rDq/4K/SEftjSdYzvI0Mu
- TLSH
  T14F540858E3E50C75E0B7D67E8AE3966AE77274159B30C3CF025286561E33AE5C839332
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  DLL/Innoextract.exe
- Size 1.2MB
- SHA256 946bd06d8b3722a791fea4d84f496139eef6faef61640924cb72f5f1998a68e1
- MD5 e34db860c5dfb3ce705c0695e6dc74a4
- SHA1 b2b560c725b1a810770f64d46d7d2ab42f7885f4
- SHA512 4fac72f8c38664a5b2e20d5604963bc7e0a388f62532f3e15b4a5a215a34ad0f16a798093d8a2e610b39c3ce3094a8b6344b35c04bfff453919909b5897c8b87
- SSDEEP 24576:LqoDZze8wrXcidU5hK2b2Z8fSuaNZ0+i1PnvIOhOc29KqhwREbVNVAVTo3jVa:a8wrxr2b2ZePnvIrKqhLVAVTo3jV
- TLSH
  T133453A65D653C1F5E89350F0140BE7FBA930AE3980309C97F788EE64BAB2ED25659703
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
behavioral17 behavioral18
- Target
  Icon/Language/BHO/ie_to_edge_bho.dll
- Size 457KB
- SHA256 f91a43e544e9cc5708578d5af55d4c9f817dcb5eea349862cd6077190a138b0d
- MD5 1ea6f501f40a452abb09e602235ebb43
- SHA1 f89c723a41653c0d99d0383d12dab15d97871e08
- SHA512 67c2881f85349bdc709add964ec47d7fbbd252220572011a3c9a88fee729a836a1fa63b8bfe3324430eb88e351f2037c574cfe566b33d5dbd000e98bb01e9300
- SSDEEP 6144:aJ/7OQxOKFiwsCrVp4ggSBsxNsqE5GEum8LExl7W4asukMsvtd2to2nmnAl0p0Xa:aJ/RxOKxsC74ggnE8E+QvW42kWHTkV
- TLSH
  T19BA48D0175D0D07AD46F207019B8E3295E79BD614F6085CB97C86DBA6FF02C0AA3A76F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19
- Target
  Icon/Language/BHO/ie_to_edge_bho_64.dll
- Size 576KB
- SHA256 782c9dae72f880c2544904fe076f8a4b203f27bccad0ffbda0a7e1540c8be17a
- MD5 5a5cb5b2f8a2e2a4a864fe1d8fc9cc9e
- SHA1 4753e6bcfa0efd085d82890bd602547c562976e5
- SHA512 1e3b1efdf2a2da80fb1bbc9154a5ab5ee5349df71818e4eadadf1f5d1205b9fe864ef3c189a981f6f2e4342129493daf79a3288bf9d90c3c795664e4a7c7e8cc
- SSDEEP 6144:J8BkAgVxUm+F//X4bavGWONLmrXsnZGoBdAEqkKXNUAl8ak405REvUhlgHaCk0S:JsXLehNnBBdAEqkKXNv8a65REPH5S
- TLSH
  T139C47E02B7E846E9E0AAC5748B538656E67178520B70E6DF03E0526E2F37BE44F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  Icon/Language/BHO/ie_to_edge_stub.exe
- Size 530KB
- SHA256 840c88dffd5f9ab9904d41b12ecb14d33ae766d032d4a97ecdc75e71e15d7190
- MD5 66396cdbf34b9c7a13a740ab5bdb5f56
- SHA1 d65b488b1b7a8564a9563135552608488780b9ef
- SHA512 4710ce7259537dc1fbcb3121496b6ef76c20e358976e9bb31168152158fd5fd20d4ca06995b238958a438413504e4c5a5974e298cd2f4a0841963966c73e2920
- SSDEEP 6144:+PjwmbA3aWSKpWk5lBT76OulUjn/9QM9YjWhoD1uuWbromncUBRY6VjhiJ:jJXHu8/SjWhoD1BWvomnnbdiJ
- TLSH
  T1FFB48E45B3E847E9E07AC5348A428646EA7178960F71E6DF03E4427A2F37AE54F3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  Icon/Language/EBWebView/x64/EmbeddedBrowserWebView.dll
- Size 5.5MB
- SHA256 704742afc7540bdf324564df6bdb9ea93d06136b8eda9a7658d3ad24d79b10c5
- MD5 c4298f28017561c2f1c13fdbe83e63cc
- SHA1 122e0525f6bc6beeca16675c17949e50e7eeba92
- SHA512 2610af19a65b3b2a7538d1daea8ca37abf20b52793539e9c20eba46044fe2c49b685424a4c98b9870f355ae263d54196a7c4adc1ada22fecb7f5a6fced92e056
- SSDEEP 49152:yGK8imh//6a1P+cRipO3LAdDnX/F8QF2jpdldnj5rjoSiSccdFqVx+5XxgtA7UED:Pl8OsZtXMd/pjDVZR5cLDDecu
- TLSH
  T149464803E29A41D5D059C178CF1B8231EB62BC490BB2A2EF2A1177D52E77BE47B39750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  Icon/Language/EBWebView/x86/EmbeddedBrowserWebView.dll
- Size 4.2MB
- SHA256 82d16d3434c9a8f6f7d3e7eaa66d0bdab9c626e319e9628ecebab1501f6ecc4e
- MD5 cd3f9f637acde895f6944cfb982d7dbd
- SHA1 620c3e3b67ecaa05b2d3395f8dafdefd554b6874
- SHA512 8add12786847bebf5c23d77539b9115f39d60b4332b3cf7d14fac855865237bbc8903e62728f2ac34f8b7141060a6eb27a50188433d039bc218661e1d3cf8fe8
- SSDEEP 49152:iXByta31RCmERFz1ND2SF94NWHLKoDa4noxm1SUkdWY9ua+99RgxpVI5Wv:6OmQfSYuUHP1QWuYTRy
- TLSH
  T1D2267D02B4518076C58161B1ED2DE77B37607B9AAFF24AD7B6687C943FB11D0323628E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23
- Target
  Icon/Language/HTML/AR/CHGSSID.htm
- Size 1KB
- SHA256 5d24b830b7146c7bb508bbafcc705948afc204906205db4469b8a36a97ba7660
- MD5 d907680f4cb2beea48769ddb27fdd053
- SHA1 c2ff273be6f6ef5f2cba75fd6a0192095ae31459
- SHA512 13ec2b6bb97b5214a2832b8b2665da8c3d7f4d9e2835687444a2d65749d2cfc4a054ae6089b59edbee8165aa7b7bcdbda72f1f32555583611ad4cf68edd9f664
- TLSH
  T13031E7921B3940320A599D0ED1F375E4D472FE23C7A6F83574A305E552CB643E68F279
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral24 behavioral25
- Target
  Icon/Language/HTML/AR/Ether.htm
- Size 795B
- SHA256 4733cffacf90715e31ebd1c09942901eee4588a01dbc7756eb6b983262961f57
- MD5 72c8416934cf3c05da8132a1dc772f87
- SHA1 472c9a7d76ae19ece535fa460c07c883bc0be3d5
- SHA512 a658fb494594ec371097ccd969e1fcfdc607fa522e53fa4ce5aff9ee54949f6e7920059fcd3920f46fba7d633196b007fadc9cc35c16370bb21f559d82205a5b
- TLSH
  T105012BE1191644700AAA5F0FD1F27DECE4763D539B96F9353003464591EA60BFE8E43A
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral26 behavioral27
- Target
  Icon/Language/HTML/AR/NONET.htm
- Size 705B
- SHA256 dde700d9937f812453b3be266b0108f07d823a756ccedb397eb4344cd7450e5a
- MD5 a6768b3e202f54d57a0f0d72f11416f8
- SHA1 0db48fa334d47b3b98f06b8109c66ff029210df6
- SHA512 a3a80259cdae9839059904696c34eeeffc0f677f0bab4b4f11fd4a552df591c388c61c607f7765a8f9745e3af33683ca2bce0a275f9edb25b4e2fc7fad0ff504
- TLSH
  T18A012BD31F15843206049E0FE2E275ECE8727D63866AF83925C306E181D7601F80A2B6
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral28 behavioral29
- Target
  Icon/Language/HTML/AR/RESET.htm
- Size 3KB
- SHA256 3b9378c7c01abe492da821a527b5d0b0e9eedcb83115f689e67cc0e76202857c
- MD5 55236827de82aea3395759fff4e97fa5
- SHA1 ba41266709b1f260f0128250be62795ed5242cc9
- SHA512 41e9defcd2b1d9b5c3d0012e3ed8250052a5dbb13c3910fe86140ee858498c574c1a3b17c44ca151b2c2b2f2a7ddf41cd3cfcd01e70f16aad0176fb205deadea
- TLSH
  T11C719AE20B1698310A064E1FF2F27AE8F8B77D2356A6FA35305B04D645D3612DC4E5BB
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral30 behavioral31
- Target
  Icon/Language/HTML/AR/USB.htm
- Size 1KB
- SHA256 715e8e03a5966fbcf699ec75139009d204798671e091ba9df7df7e74951082c3
- MD5 048d1c470553c0da1cbad8482175eb91
- SHA1 bfa89bf4876c46d89329722bafb8c821e43144cc
- SHA512 8d40d58125f2fbb33360751d320576128bd2a187166b0a6167c8b75a5c70e2e9f9fe912ae2bd4cc2ab90a57ad3b861c7ed7d28431e79eade15c1ca227cec2050
- TLSH
  T1CF2134910637047106AAAF0BE2F53D68E87ABD53C34BF82124530A01A6EA617EB5D97D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32