Overview

overview

6

Static

static

5

toolbag_in...01.exe

windows11-21h2-x64

data/shade...mat.sh

windows11-21h2-x64

3

data/shade...put.sh

windows11-21h2-x64

3

data/shade...sor.sh

windows11-21h2-x64

3

data/shade...ise.sh

windows11-21h2-x64

3

data/shade...ing.sh

windows11-21h2-x64

3

data/shade...pes.sh

windows11-21h2-x64

3

data/shade...end.sh

windows11-21h2-x64

3

data/shade...ask.sh

windows11-21h2-x64

3

data/shade...ing.sh

windows11-21h2-x64

3

data/shade...ler.sh

windows11-21h2-x64

3

data/shade...til.sh

windows11-21h2-x64

3

data/shade...ion.sh

windows11-21h2-x64

3

data/shade...int.sh

windows11-21h2-x64

3

data/shade...ial.sh

windows11-21h2-x64

3

data/shade...set.sh

windows11-21h2-x64

3

data/shade...red.sh

windows11-21h2-x64

3

dxcompiler.dll

windows11-21h2-x64

1

dxil.dll

windows11-21h2-x64

1

embree4.dll

windows11-21h2-x64

1

libfbxsdk.dll

windows11-21h2-x64

1

nvngx_dlss.dll

windows11-21h2-x64

1

python3.dll

windows11-21h2-x64

1

python312.dll

windows11-21h2-x64

1

tbb.dll

windows11-21h2-x64

1

tbb12.dll

windows11-21h2-x64

1

tdr_adjust.exe

windows11-21h2-x64

3

toolbag.exe

windows11-21h2-x64

1

usd_ms.dll

windows11-21h2-x64

1

vcredist_x64.exe

windows11-21h2-x64

4

viewer_install.exe

windows11-21h2-x64

4

zlib.dll

windows11-21h2-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    toolbag_install_501.exe
  • Size 240.5MB
  • Sample260711-q4e1mady2v
  • SHA256 2b284e23c083b4a83c65497c5540f45964b8fda102c137426f955623a357201c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoveryinstallerpersistenceransomware

Malware Config

Targets

    • Target
      toolbag_install_501.exe
    • Size 240.5MB
    • SHA256 2b284e23c083b4a83c65497c5540f45964b8fda102c137426f955623a357201c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    discoverypersistenceransomware

    • Adds Run key to start application

      persistence

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1
    • Target
      data/shader/paint/layer/layerformat.sh
    • Size 4KB
    • SHA256 bcc5060e85ec7800bb96de6ac561e6b720a8f658ea39d5a529490a1d8d1ef482
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    behavioral2
    • Target
      data/shader/paint/layer/layerinput.sh
    • Size 4KB
    • SHA256 2795493f3c3ef322245b455a20bef0e7d68402722991f68c075561e22f353be7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    behavioral3
    • Target
      data/shader/paint/layer/layerinputprocessor.sh
    • Size 4KB
    • SHA256 5ae2dec3330480d5de8604f2a1c39fe74b77bbc87699af928a9a212242f1970a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    behavioral4
    • Target
      data/shader/paint/layer/layernoise.sh
    • Size 2KB
    • SHA256 18b29184f5e266416657775d9286a6729f4ce5df72c661b99c716ef0da8862d2
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    behavioral5
    • Target
      data/shader/paint/layer/paddedSampling.sh
    • Size 463B
    • SHA256 fb1d9ffebc8d10505528697577e263c6e41e2860a4ce7b6ab3b86357ea80146e
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    behavioral6
    • Target
      data/shader/paint/layer/padpixeltypes.sh
    • Size 907B
    • SHA256 185498fbf670a455bb4f13ca18b9864566c5b9878f011b72c38cdf814c873414
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    behavioral7
    • Target
      data/shader/paint/layer/sampleblend.sh
    • Size 1KB
    • SHA256 128694b6e1c5f89893757ebe888158bc83544284d9df765d08fcdb2d93180e2a
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    behavioral8
    • Target
      data/shader/paint/layer/scattermask.sh
    • Size 2KB
    • SHA256 320a99dd73c77edd29a93858166ece80aca91b18d32811fce17becd4e6594305
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    behavioral9
    • Target
      data/shader/paint/layer/skirtPadding.sh
    • Size 6KB
    • SHA256 9345f3333e28dd690dfae22c705c4bd81281de8c21dc47fb730782280c21d8ac
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    behavioral10
    • Target
      data/shader/paint/layer/surfacecrawler.sh
    • Size 23KB
    • SHA256 e56a97b226a38293b7c3131734dfdd4222893414d7dae0a8f384b23dccc2e24e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    behavioral11
    • Target
      data/shader/paint/paintcompositeutil.sh
    • Size 272B
    • SHA256 b9e5134ef03249852f14ce94ac8353d25c330e5179e6e37a9e8fd9bb870291f5
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    behavioral12
    • Target
      data/shader/paint/quantum/quantummultiplication.sh
    • Size 3KB
    • SHA256 3bdd1b6da31138c3782aa9bcc8ed90780ae72230b2f4a92cb14c577234b4064b
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    behavioral13
    • Target
      data/shader/paint/sharedpaint.sh
    • Size 534B
    • SHA256 b57fec93469a537b5e43458ba56949de10113dfd6a2e20066f6b161a2e85baf5
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    behavioral14
    • Target
      data/shader/scene/raytracing/raydifferential.sh
    • Size 4KB
    • SHA256 51fab894b40b670f4a10aea563fc188a774e72a2b91665c2596594a4916cfd38
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    behavioral15
    • Target
      data/shader/scene/raytracing/rayoffset.sh
    • Size 1KB
    • SHA256 5a0cd500144beeca6e6cf7e00354268861c8f85830940cd13536dbc063b6b4ac
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    behavioral16
    • Target
      data/shader/ui/quickdrawshared.sh
    • Size 840B
    • SHA256 9bdd14379c44676ed645426c802486928cd6c0964759198b0f9e240bac49adc0
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    behavioral17
    • Target
      dxcompiler.dll
    • Size 17.0MB
    • SHA256 eb0e6196eae92f69f7e3a8a0bf0e35f30d7c2adad475bebbde3a41015ca0b414
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral18
    • Target
      dxil.dll
    • Size 1.4MB
    • SHA256 1f61b171315ecffabdf56d4216e77d56533e3113f8fe29c5ad34a45c52c91efa
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19
    • Target
      embree4.dll
    • Size 588KB
    • SHA256 77d49cf7fe896036f345bdbe9b60f41d3863f92d4e1e05a8ccf0a6669d8ecfdd
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral20
    • Target
      libfbxsdk.dll
    • Size 9.6MB
    • SHA256 0c152e1eb554c5f3c526b60e465fa701371179cb6708664ac021d6588fa70d89
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral21
    • Target
      nvngx_dlss.dll
    • Size 48.9MB
    • SHA256 8bea8eee99861d0cdc9b8b90e1fb915f5d96750c2d575ed8d2417452105581df
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral22
    • Target
      python3.dll
    • Size 55KB
    • SHA256 9060c732fcc0129c87e130c17eb48361f397cf411a3feac7f27d72be254546dd
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23
    • Target
      python312.dll
    • Size 7.1MB
    • SHA256 65878118708a7cd6d5257e447e9ed960ff6ec920aad998ba5598257b8407b35d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral24
    • Target
      tbb.dll
    • Size 391KB
    • SHA256 692380cecd03181d7fd536e4402783e7f38ea0765b35bb52a3236256959b40cd
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral25
    • Target
      tbb12.dll
    • Size 312KB
    • SHA256 bd1a76d99bb3e9fe08643a98b11ed1eebcb2b6b7b6da60d01925a52077e9a00a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral26
    • Target
      tdr_adjust.exe
    • Size 338KB
    • SHA256 63946f45316d97a31bd62ca4ae7b004bfa76d518a463eb3f1a2efe1a58cdbed7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral27
    • Target
      toolbag.exe
    • Size 21.7MB
    • SHA256 73e8e5a111d005b96ef6f8bd77bdbdf11ff7cd1d41eed1cdb9991aae3e4ec698
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral28
    • Target
      usd_ms.dll
    • Size 14.5MB
    • SHA256 66226de43933f480c496a2fdae0fd21ef59fd3170718735f2e1d19abe4a45de5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral29
    • Target
      vcredist_x64.exe
    • Size 24.2MB
    • SHA256 3642e3f95d50cc193e4b5a0b0ffbf7fe2c08801517758b4c8aeb7105a091208a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral30
    • Target
      viewer_install.exe
    • Size 35.5MB
    • SHA256 a1a1c2fa7a2ef869ab01d0bdc84e47631caf180af7ebcd5b3262874781e7790c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral31
    • Target
      zlib.dll
    • Size 82KB
    • SHA256 e8f30abbebd3cc257144a7afcec99ad51449e008129db2e6489c451317d9d8a7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral32

MITRE ATT&CK Enterprise v16

Tasks

static1

installer
Score
5/10

behavioral1

discoverypersistenceransomware
Score
6/10

behavioral2

Score
3/10

behavioral3

Score
3/10

behavioral4

Score
3/10

behavioral5

Score
3/10

behavioral6

Score
3/10

behavioral7

Score
3/10

behavioral8

Score
3/10

behavioral9

Score
3/10

behavioral10

Score
3/10

behavioral11

Score
3/10

behavioral12

Score
3/10

behavioral13

Score
3/10

behavioral14

Score
3/10

behavioral15

Score
3/10

behavioral16

Score
3/10

behavioral17

Score
3/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

discovery
Score
3/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

discovery
Score
4/10

behavioral31

discovery
Score
4/10

behavioral32

Score
1/10