1c37a89621f2f54f857eccc09911bc09daaa475ec4245a40fa905e2261cd3e49

Sharing

Copy URL Twitter E-mail

General

Target
Ras Tweaks Setup 1.0.0.exe
Size 93.2MB
Sample260714-hv7qaagv2l
SHA256 1c37a89621f2f54f857eccc09911bc09daaa475ec4245a40fa905e2261cd3e49
MD5 d4d607c4c91fe059f0ffe6ec6579a6f4
SHA1 b485d3f3b7754ff0fc3a17abdfcf2eaad53c724f
SHA512 a7311927e8b33bd4b23b452a3c7d1807e5dcd4e763f0792acef6bc5f8e1cf799bbd7f70156e1e0b75ad3f89476bd9594f3a890b35ea49ecac402cacc1689963d
SSDEEP 1572864:8r2um4Ndc2to2Cjlv3xkXwqip1jM4ujn3g5CFZtJttVyt7UQnhoDO2wGuMqtlPwF:8rTm4PFCjlv3aXwqOFnujICH1yVN6DAi
TLSH
T113283355A08E28A2C3C1AC3E6256164F82E4D211A5B37BAC4B7F97FFB3D3D598774081
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Ras Tweaks Setup 1.0.0.exe
- Size 93.2MB
- SHA256 1c37a89621f2f54f857eccc09911bc09daaa475ec4245a40fa905e2261cd3e49
- MD5 d4d607c4c91fe059f0ffe6ec6579a6f4
- SHA1 b485d3f3b7754ff0fc3a17abdfcf2eaad53c724f
- SHA512 a7311927e8b33bd4b23b452a3c7d1807e5dcd4e763f0792acef6bc5f8e1cf799bbd7f70156e1e0b75ad3f89476bd9594f3a890b35ea49ecac402cacc1689963d
- SSDEEP 1572864:8r2um4Ndc2to2Cjlv3xkXwqip1jM4ujn3g5CFZtJttVyt7UQnhoDO2wGuMqtlPwF:8rTm4PFCjlv3aXwqOFnujICH1yVN6DAi
- TLSH
  T113283355A08E28A2C3C1AC3E6256164F82E4D211A5B37BAC4B7F97FFB3D3D598774081
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution persistence privilege_escalation ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  resources/app/Tweaks/RAS+FUNSPLIOTS.bat
- Size 1KB
- SHA256 07ce938df15fa742fc130c8b3919bfda47329407d4b22b1a9302a0f590ee7a5e
- MD5 5dbd6ed4f0b6ec92361dd2189dedd26b
- SHA1 ad4f715d4b4377ea1f724d00bce297399cab2412
- SHA512 0e075dcf83bc1a16b896ac795655b2bd13ea6a644d75aa6579964a5d70b0a830c7d04a890596407a0b729c7326ead4a354bb50a762a9e9f3c25bf333c32a3d74
- TLSH
  T19A2121B312E42916152B46BE3A1FCAB01B63D5B98750B34C30AC4AB6260C55D197FE02
- MD5 SHA1 SHA512 TLSH
Score

6^/10

persistence
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
behavioral11 behavioral12
- Target
  resources/app/Tweaks/create-restore-point.ps1
- Size 1KB
- SHA256 e32f3f706b2d10d8de048536e28a73f6ff88765fc06064d3aa6cd9599a71a2f2
- MD5 0cf8106413c7e4e19bf3710355d4fd60
- SHA1 69e6ccf02c6d87205eda094833275edae93fcc69
- SHA512 c40670aa664a4709469a45fb4804079b662c367e552ce5a2c34a2c0aae6fb07ad9c21ee40b2f09e4f73136f70767bea90d6cda2bcdfb2b3fd097abbec9d4be90
- TLSH
  T176212602D5402A208896425B1C3FA3D1AAE283FE86013D50F8DED5067BDD5AC8F63B5F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution ransomware
behavioral13 behavioral14
- Target
  resources/app/Tweaks/disable-cpu-mitigations.bat
- Size 1KB
- SHA256 059f425eb4a27d85c1c2d2b4d1cabbb1590f1e23ecdb7c0f3902a48dda103f22
- MD5 615f08636b1a4d90fd599172699756a0
- SHA1 a60887d5aab695cc31af0ede8507fd5781b98140
- SHA512 61639988aa2a304943c3c9f7e81aade58ed22c17178f5c72e38627cb3b26bddb53e0a1c27cc1e312f42222aed72021ed070de68efca2d2d0f685b5708c688b82
- TLSH
  T1ED215362A2DC031998938277E7074222773FABC2C11065EE142AEB2C309F08C57BB596
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  resources/app/Tweaks/disable-fullscreen-optimizations.bat
- Size 1KB
- SHA256 1d39768042cbf6dc3e53c040ded43eda12b48868707db629d098c2a0386b80f4
- MD5 1dcde178ce7de134ff7d3f91853819db
- SHA1 5e78a7939f65bd7715907603dba24ab39900f242
- SHA512 a80aecf16efb91db7ed1b356051f27818e289370a91e2d836e3e9e1ce8197022b4e84374b7a3b224a229a433908532ac0ed6e01640aa31d1e63f8db55a0a04aa
- TLSH
  T12C2112B1DDC511A3D12318BB9E0B10A37F3A6757010A926520C8815E211F30E2B6BEA6
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  resources/app/Tweaks/disable-hibernation.bat
- Size 375B
- SHA256 dadd087bd4bb6c24e6fe1a2a83243cecf017658affffd1c2b2acb32d7f8b7b5d
- MD5 15ef54ab09181cb2c783b78aa61d7e41
- SHA1 c99b49c6b379b6a6be1f869a37dc41ccafcc53a2
- SHA512 6bf892f724b66f4bbbde41bf3b286b845366b5cea1f759d28b88b4f085fecadbf010c8fe01647688eaf57e62249c346cc05b0a7d799c807ed5fbfddcb066b427
- TLSH
  T1E1E0D87A54D0203B5C23E4772B5942432F6E05CAC262B09D38956179F14E96F9BCFB53
- MD5 SHA1 SHA512 TLSH
Score

6^/10

persistence
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
behavioral19 behavioral20
- Target
  resources/app/Tweaks/disable-paging-executive.bat
- Size 1KB
- SHA256 4aa0ccc86c2a9465bb2a2e3ee431e0b51033b36cd480b2d6becae430b927d784
- MD5 ebb0223707edab686d0dd927814911b0
- SHA1 114e15b07f298ec783a2477ec335eac71da97a35
- SHA512 0f83b692b40b897b2c879cac3b14f3d0bc21a15902dde5faea0335527ad257bfd67de1f7e0a485d6550816f98032d5fd874a0d9c499566078010afb25a7cbe2b
- TLSH
  T13521931403CC2629D97342F7722A8593376F92C3C301E67EA05C038C76EE08EC13B96A
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  resources/app/Tweaks/enable-hags.bat
- Size 836B
- SHA256 1e2689befc2e1f4b4bb8efd7e2e91c359d519a58e223bdff501c94490c7818e9
- MD5 5eca6ff0c95f7b8ef88f80e06f406fe8
- SHA1 b6894e1b6da15b09452969333f7faf87d5b2bc72
- SHA512 5534b12a99fb42d80795d4842990f867f0cbce59e3413b20db4d798e44b55261e334e0b700d956e012bd040a0cf59ed310e50b18400adbd4751fe9043d030483
- TLSH
  T16D01EFB37AE81664B5434179B42747417B67D2814120F01CE85E056E715E45E1FB7AB2
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  resources/app/Tweaks/example.bat
- Size 180B
- SHA256 4ce2a28f3d6dffe148a5ed359506876e8b3a2bcb62a446de29e053cfbffaf812
- MD5 3b759254fc6f8754d4efd9b079534de1
- SHA1 a8e7cda05cdbd8ec44aa3b4bb7d3fc9a0edbd928
- SHA512 f2f6a5498433d0351d1f5bd05428278de15368f06bb8bdeda453eebda10051dd6283275394a860f2a6d34487fe9f57af086da1afa6e56aa11eb355e1f6a96a9c
- TLSH
  T1E3C080CF56F814C910C11991715F01537ECEA147D16CBD2344A7A2559C0819F74BEFD4
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  resources/app/Tweaks/exclude-driver-updates.bat
- Size 831B
- SHA256 834e5dab75cf1cff9d6a26777fab11e25ed01ccc533dc080a66fc24c3aacf909
- MD5 7d2a9137afd15571ab3819f8768da368
- SHA1 37972d66d85d64456548dd2b26460faf334f139a
- SHA512 0c03e80b1ac443627de91d45c0f4fbbbc50b96edbc86ff6fb5400ac551945ee9a667928439741197046591c26b25b9c533af6442f9c421d1b51f4824bacf8114
- TLSH
  T1E401CC2549AEC533D82BB1AC6E4F4103AFA6628316CE6B4120AE0506D07F08F261E7C7
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  resources/app/Tweaks/flush-dns.bat
- Size 174B
- SHA256 578c512aa84b7eda92a60ca086eb14aaeeb62cc18cb4180aac473f2eec810924
- MD5 295b9fb3064c41129b8c0e50a585f956
- SHA1 6d4fabe6f75ced3ef44518b102f94b72244d3655
- SHA512 03f9f7540d6d1e6a8743206ba50025958e5b9273949d07b93a4514e6db703253f121969d463ee30b5a1186784d47e71133d6d628fe8d890aab7f2c81702f146d
- TLSH
  T1A2C01233D28A055E90160D559B46549524DD1293561978943292903A11854B538E9A91
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  resources/app/Tweaks/gaming-latency.bat
- Size 1KB
- SHA256 bdda3a798ef7b96c62a69ba27fc63561c1bdf0364588d3efd2dcb31cf50ef003
- MD5 8477d9f1bdb45a418a2f1ad510c9ff89
- SHA1 ba253dc6ab4ad14322a0b3c16d1ba96db35e5dbb
- SHA512 70143bcabca51e6751fbab969848001d5a30e00f68e3acccab12eb0dd5a6f47352b87a8d11084ef0cd4c991069d3cb90791c23cdc8b524e5244af6b9eea42e9c
- TLSH
  T1E73164730BD80293B433F625BD1F5183776B02838648B28C38AD6159106F84D49BACF7
- MD5 SHA1 SHA512 TLSH
Score

9^/10

evasion ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Power Settings

T1653

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Power Settings

Power Settings

Modifies boot configuration data using bcdedit

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32