3468416e3d09b842d4b03a8dd87fdec56ac8ddc7ddcedd457c24dcf92f1d8da0

Sharing

Copy URL Twitter E-mail

General

Target
Message.eml
Size 54KB
Sample260709-sg6aeadv8t
SHA256 3468416e3d09b842d4b03a8dd87fdec56ac8ddc7ddcedd457c24dcf92f1d8da0
MD5 8c8d6bcfee6e9b3896d0be3778b346b2
SHA1 3cc8bd7209c39d09017860795b79b99fdc8f0038
SHA512 66fcbb2ff451dd6d5db4778f20540f66384f72d3e4efdc5aa0f1d1764d331265ba585b78b7d6d1398419fd44f9c7b41d25a4277045eb6d1064a41194736a893b
SSDEEP 1536:a70FqH2Y/lSxoB7ZP49h+HODhz61To/0GKz7rBJ8vTbbf+sxc:aoFklvh8qJSzF6
TLSH
T1C143A457B7C05C54C87B59B0A4037B7CBB795DDA8B2248B0A4AB3A3F0E4CCD786D6248
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Message.eml
- Size 54KB
- SHA256 3468416e3d09b842d4b03a8dd87fdec56ac8ddc7ddcedd457c24dcf92f1d8da0
- MD5 8c8d6bcfee6e9b3896d0be3778b346b2
- SHA1 3cc8bd7209c39d09017860795b79b99fdc8f0038
- SHA512 66fcbb2ff451dd6d5db4778f20540f66384f72d3e4efdc5aa0f1d1764d331265ba585b78b7d6d1398419fd44f9c7b41d25a4277045eb6d1064a41194736a893b
- SSDEEP 1536:a70FqH2Y/lSxoB7ZP49h+HODhz61To/0GKz7rBJ8vTbbf+sxc:aoFklvh8qJSzF6
- TLSH
  T1C143A457B7C05C54C87B59B0A4037B7CBB795DDA8B2248B0A4AB3A3F0E4CCD786D6248
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  1.png
- Size 2KB
- SHA256 cfb6bb8586dc9f575e86ce96257cd41563511e4a670ff687a8b6f3e9dca5a1db
- MD5 422e9d904e80324944e724f7d41a728c
- SHA1 f33c1ba85ea6e819d108600612b2be6ea393287f
- SHA512 642ff55c5d5e9135b3a9e6fd0c92e4a7318cbf6866b9557c49f61efc66c2c2e89d70359334c2b264ee954ade29c912b23ac5b8df042fc976e52946c7eb9edcb9
- TLSH
  T1BD515CD39698300EC0E54B218D871210C9EFD32F499B579ADE46760A3A70F3C7146BDA
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  2.png
- Size 921B
- SHA256 8322550fe1b7ed3ed89a2f8ad61a77c628c1d33a8b67cdd1d08caabb6d6dd605
- MD5 f684395d1fdbad9b8196a6a9248b7a7e
- SHA1 24444e89b78504f04a5196a02bc65e8154472cc1
- SHA512 eb84244e38a6f2fe481a41b1962f28696fd4bb2a1d4083caffec1cd1cdc2b324c1f7bd8cbde536dd11336b1c112fb0033988ef24f6ae90479d50e1479f8f5261
- TLSH
  T1CD11B77D3C9F1859D088B2250602296C15F2876FD5960D4C1C7982B86278F242BBA829
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  3.png
- Size 3KB
- SHA256 0a9e89001f52351cfc61df359d569c1a5f730b3a195d70bb0c51c0a4d2800673
- MD5 ef971f0a20d0d378de0740921c43aca9
- SHA1 af6775d1aff8c1ffa484f970b3c5dc6566f20c36
- SHA512 b71c8827776142945aea8602eff3c409675b933cc1d01a6af8b836e622e3c1b76f91e7f7583fe2a9fb6b196ea4b97f01746d81f336cb705f3df177365785e934
- TLSH
  T10B716EDB3162C0A859C83A3C91EC5A3E435D0B924343035F92FDC96854D5AD26E2975B
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  email-html-2.txt
- Size 24KB
- SHA256 c4a1e18b4f3aa98809efa527ba772d3105dfaa709d4cac334db813d49ae3add1
- MD5 334822e92ec37bfbf297c166f2b9001e
- SHA1 7d37898ee7a22bc6f6b95bca6e4ad5419b5969d5
- SHA512 d2ae004c27ba3b3ee5616bb7303780ba168db58d657366a46e66344165b8bf1c4cf96196e0689fc894df52bb8c360f2ef04df400e2c3db5c25fc81239b930abb
- SSDEEP 384:P7BmOTcmOTYDKlFdzHVCsRONQqwzC8e6B:P7BmOTcmOTYFsRMc+8dB
- TLSH
  T1AFB23153F3C01D18896F4870E1537BBCBB7945D68F6209B0A89B3A3F5A0CCE686D6658
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral10 behavioral9
- Target
  email-plain-1.txt
- Size 2KB
- SHA256 52b621f9edf5677eda2ba2fc2f8be8675789959b5ae1e0d5402aab75578f194b
- MD5 83fc547a873977db14e709e706bbabc9
- SHA1 a59f0b8527e0548bbe48b4630590d686d216325a
- SHA512 153ddf9365c3eaa6924b0c05ddc9f4f41febff78cd5f0b7260178355168194c3d1d8917d19613b5dd88d68522ce757b800828e096bc5b8e4d056ae1df4700588
- TLSH
  T1495154FBB19A21D4659770F1FA8B14CDC6AE4435CA03C13DF59AED2C2730F9AC095199
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12