9e17608b2fc581529bce496d4148079a55d5f49bed38f05a763293dc6df434b6

Sharing

Copy URL Twitter E-mail

General

Target
cadencii-master.zip
Size 17.4MB
Sample260715-rh24psht5w
SHA256 9e17608b2fc581529bce496d4148079a55d5f49bed38f05a763293dc6df434b6
MD5 0de13e5e6bca4837256b792b8e17efa2
SHA1 1cbbeed076b509e210d8e8693ff74a7abe19dd0f
SHA512 84e254ceeade185dff235da7100b330977031058eeb3be703d21d3573de0e3b161c4c75795267abdc61ab42348038504566dbefe7097cab77f88959d6601e8b2
SSDEEP 393216:5yz6GqkgwjEOTaCWNXCuX5ljzcdTig0O1caRLlKWOLDK:5ymZnWNTaCjuXECuFlDEDK
TLSH
T16D07335A50076B76CA43707AA05AC315FF20D940A988FD1F5BF6122949E7EDB4EE033E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  cadencii-master/src/Cadencii/ui/dotnet/UpdateCheckForm.resx
- Size 5KB
- SHA256 4d3ee9059f5b98ab1806f6916ebea2a8c56023f8c63ddfd80b7378d27d1aa0f6
- MD5 96ba0a444d087ae06f32319ca4f0a3e4
- SHA1 e3e08973b3d47c1ad51ccb133315b6242e275f0f
- SHA512 571d4083c76428d8c3914b2bc1281cc79ed4603b5fe0e3e82ee58dad488fcfe7f797a45b0ea7f14841a2a100656f059c186b7338ce33beb910cdddbf9ee70cbb
- SSDEEP 96:ECf+lbD5X5LPXCazYV5Lv6K6uOidfaxwsxuUPFC3qxdRMvDbu8KsrbEKAy202lUt:Zf+tLPfYnLvFVOiFQaUD7Ut
- TLSH
  T172C11E45B2D1ED260E93483CD65139847BA8923F0234AC94B4DC961E5F92B85A7B33FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  cadencii-master/src/Cadencii/ui/main/FormMain.cs
- Size 870KB
- SHA256 127b8a1521834f1c284007a87f0af9c8f8b7d4261bc8027dd5fb0c6e8b8ecede
- MD5 3d071a64c294ced8c7fd505bdb8a49c2
- SHA1 6412dca8eb862a2c2c733cf382fea301d3cbf08a
- SHA512 9adca5ebc1b8fa6eace54d97d86e627071d69da4576065413bb51840d53273b0a2f922db7c690341739b81fc766ed71c0785610d921a399492439f277d9d779b
- SSDEEP 6144:MfTWNkGMr2hkIwcyPTInoCcoIsombs1aBeEw1gbFM1aoa5KlNfl11S3lDvg7JPxi:MfykGM/b/hf9LRwe2
- TLSH
  T17115D61F134D12B744B6733BEF821089EB325473829662A23D9DDA6A5F7605283F0FB5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  cadencii-master/src/Cadencii/ui/preference/Preference.cs
- Size 60KB
- SHA256 77a917f82a85e043438caa2b3d40e99d912521580affa3af1ec8af3dbc39e6d2
- MD5 f13ec02fd15e0b91d1906a6547a2c35f
- SHA1 b470e95832aaad6d3dfd361744eb35f4f62a1272
- SHA512 79edb1f3dd4d602263e96fdd116943969404a667e32c9ee810ea25fe63b4a271902dfc8a509998a65e99d645d594f47dc3efbb6240763adf4abf54c5ebf0cd70
- SSDEEP 768:2qj28rO5uFJtBxzYDSbZ492n7srpsE/20jTUPD/T3Y323o4GwKpmr2x7V:2qU5ghzYDSbZ492n7s2C20jTUPD/b4
- TLSH
  T13853710E694696314536333ADF87894AEF23196B805561E17ECD82583FB2804C3BEF7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  cadencii-master/src/Cadencii/utau/Oto.cs
- Size 4KB
- SHA256 10f3b3bda974cea44469a04486383276d764ea19071ebd874df929a7e0b25f1a
- MD5 a67dbb239e32cc916c325353a1399ad2
- SHA1 d91dd320d3eec4e4db33abaf064724749ffbd7a4
- SHA512 4088426a268836c1e3de50172a121090c7cc453bbd48864da6acc45fa774b47a62cf74db3c70d48730325285cf3ca44045732f66e2ddea242a988e1b441f3f96
- SSDEEP 96:Fkuj4YPK2AL3DCoFBwXpHF69PkSC2utCkyL:FkBkAL3DC9XVF69cSC2utCkyL
- TLSH
  T17E9172191EFBA8644E633294AFCF20495322BC97E60DFC51BADD7700AF4106092F6DB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  cadencii-master/src/Cadencii/utau/PrefixMap.cs
- Size 1KB
- SHA256 ebe46ea085cd3eba653b90eb341f6fdd37b50dadb763b285827beff3a73052af
- MD5 c9291656a971503eadb8c3cda2aedaf2
- SHA1 44593e0bf91eb460bb417b4a895cf708e88c3dfc
- SHA512 e783a8d9e3622bf5bbc7625b24385cdbe0cf68942e90b94d8867997e49047617378d7a9e31ff4f1a9cc3427248c84b589b7c30c385d488dec7d772cb841cbb88
- TLSH
  T14641402916EA4FB304032665F79F502853367A83306AEC12BCCCB3048F8B694C5B1F9A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  cadencii-master/src/Cadencii/utau/UtauVoiceDB.cs
- Size 3KB
- SHA256 d9dd29453710134841ac8a87308d134d612ffde0df3cbeec760a59dbb24c371c
- MD5 735f62eaa3ffb73c2f0f85fcbe16d922
- SHA1 7ffc23caf36f90061f1722fc4780c298050ead17
- SHA512 d946af2c3bd752641f891d26de77ec7fecc6ee6d3cd01d8144915fec66877a1d001edaea2267c6732b81d0990093d4d68674115b495ec8b06fd455027d600744
- TLSH
  T10E61101A39C99A750D336379C399B00AFB636E67611AE514B99CA3015F301C150FDED6
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  cadencii-master/src/Cadencii/vsti/AquesTone2Driver.cs
- Size 8KB
- SHA256 4cc8ac700c2559dde2e59d2a98b8367bb6fcd73db13165567d44c1d277b823b0
- MD5 c4af16211b6f6ba91d3a5ab38f4d88ad
- SHA1 a431b1f518ac78d33ebc427f9d3fe1cd51ba9d4b
- SHA512 7b94b21cbf86fabf1893eba69e66d50bb385bacd238d4b68dbc6cda632804b0de9312debe67c0c2fad19225a552a8c9c719231e5c23375cb79d751be97fbf487
- SSDEEP 192:jkkqF0bHEgVEDPu1TCv8vTVAcRS4AbFyE:jkkOEpkpUTSx
- TLSH
  T1DB02512CA4F2CE170D4360A44F4930432B149E67F90ED9257A5D6F20FF8D89A6978EF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  cadencii-master/src/Cadencii/vsti/AquesToneDriver.cs
- Size 6KB
- SHA256 64f4f7a69daaaf8bd9c2c1b3a7a42d6a599fc91b267d8254ab10615d7b19371e
- MD5 920d4fd5c9941045197bdfabf5fd861b
- SHA1 a6664ab895ed3c95b036a7c2d64d8326edd3d35b
- SHA512 f42c6cd1b990d86a223957202333c2dd9adcb5b472d720e9121d030d04b79b5306cc9d14e304c96f90bafe5f7aa20a79b760c4d7f493201dcf41690420e75f73
- SSDEEP 96:sRMioX2n4kBPsfmiVQ8pPTdwzB/S241exZ69k/F:sV4ksZqGBwzB/St1/aN
- TLSH
  T1E8E1315D96808E57143A1D3ADB046361F30A1F6FF93AA093797CD22A5F3D4844268F7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  cadencii-master/src/Cadencii/vsti/AquesToneDriverBase.cs
- Size 3KB
- SHA256 0bd635bd7995ed7b322dc30d3ad41954b5508ced2fd372cb6e6282348be76929
- MD5 41f4d04034f21ddb58dc24660bfda746
- SHA1 d5db947e50f264e957e1e9c3d2cf154b9d26f36e
- SHA512 3e1c9b9a4ad0f9c00c1acbd7693b93432eebf94e59305dcd7b4bc35872b2073d435b2572c9f38252d04e29a1ce411abdc1f2a0e40d7ae2b6d50832d5a4b4aa14
- TLSH
  T1E281A91E75F78A21806330F6970F20D927256E13A227FDA1799C5B14DF891CD0FB07A5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  cadencii-master/src/Cadencii/vsti/VSTiDriverBase.cs
- Size 18KB
- SHA256 262cee52369e104223ca1191c6103e846ffa1b59e0b21b22f819141ad102d0e4
- MD5 790e9e4643bbd74f4e61f53efa1f70da
- SHA1 96a7369919311c38db89c3392244141c0a770588
- SHA512 636284e75a48a53f92610def7d5311ea259ade84b977025469f597e05ec02c87db85514e96951290b3d231981a9853ee6beb776a23518807914ab03df607a9b9
- SSDEEP 192:BD/DHzoXpejKRjQgyRKRZRgemQYAMkMLpQDp6RmDEGQB+BmVWLH+XCziV:p/DU+KREgyRKRZR7mfqyRmD9QTScCy
- TLSH
  T1D082504C09541E2508B2737FDF4B5889FB772863475091647CAE8B322FB6065C1A5FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  cadencii-master/src/Cadencii/vsti/VocaloidDriver.cs
- Size 24KB
- SHA256 1d76ed2451fac405a7323df94d775206be869f730be9ca7e9b572f48202550ce
- MD5 3df2f32aece3650af5f4faeb7b6ff1ef
- SHA1 1245e0bd219db6f1a0b30198d73ffd28e39351a5
- SHA512 51f95b2b2b140f6b080be2963958d1ba87998ff0a4f5cc85e6b88a1a3e958d03000c7394ee0f509718ee48438f070b25f599c323016780c04a72cdcf2576ee46
- SSDEEP 192:BsRpz2WAAmMsictLMOZq0zf7fBDaKp8uZNH1vdCMJg5xnFDophbG5MJEwu30M/V:+RyzNV9BS2jUmg54pNGEN2
- TLSH
  T12CB2852D1094156A4475733EEF96012AFA3266A373A0A23AFC9C8F616F7505593F0FE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  cadencii-master/src/GenerateKeySound/Program.cs
- Size 7KB
- SHA256 f227db2112bdf7062eaf9740ba624795a253d7c3ecfa4df9241d4dd0e5b610cd
- MD5 aee056449f52160147a1cdb370437635
- SHA1 972d9c17351cc2fee57577ceba7188b247b9c750
- SHA512 53ff07925d50dff9b43dcfaa54460e46d6480f6179eb064002fb8a795172a84b8aa5347ec680a05c873b1faf57ac0ce68898c7939325d5545bb40a3f890b5f9a
- SSDEEP 96:6zBo4DySWyR9nJ/ysoCox1o/+HvDI9IGkDsx6Ii7sG:6zV7JjoCox1o/sr8Zx6Ii7X
- TLSH
  T162F110581C425AEA04326339AF63DC8AFB7247B7552526EB78CCD3465F3084A4278FF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  cadencii-master/src/ScriptImplement/DivideNote.cs
- Size 17KB
- SHA256 0b2da71fcedcd3f52567ab550cea5079586f22342bb1fd5637ea08e8fb67ae67
- MD5 0cd9882b6ce2f26a0700a3681256776b
- SHA1 feae0efb64a5c2748bddd445a9a182133cf8fb03
- SHA512 97fb85d4dbdab05e58ab4582865166107589486429466eceea7bb6755a521bb7f472a744a5d49a8a43b3edf13be54589a7bbee0dfc5be55e7ea274b1804e4ca6
- SSDEEP 384:T0d523w7LxtNXl5md6U5quNDcYKWWa8F8Hn:KKiZ/Mn
- TLSH
  T1D88256AC135D859188F2732DDF119A40DF36093BDA17A968BECE8A809F721644374FF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  cadencii-master/src/ScriptImplement/Properties/Resources.Designer.cs
- Size 3KB
- SHA256 e3f42e68d60608e564434b6339fc21805887c1b8783c0e4cba2c6a15b93c61f8
- MD5 c9ae9b2657113185c5c03c237cc6ebf9
- SHA1 e062ebc1ac85e14103f3ef15ba5f748343c934e3
- SHA512 70d26bfdb375118cd747c173ca0fb5df38b3ae50168b4c9102ac11c61ca04263f122cd61839e31fb10f2909ba2d1d693f2b8e4d4562cd4b0f2ba1c66ed27d265
- TLSH
  T14A61CEBE1FD4C1320934E29B8B09F451EB551C23D92EE534786E82206FB6388836DD7D
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  cadencii-master/src/ScriptImplement/Properties/Resources.resx
- Size 5KB
- SHA256 66b5ebd1b0fc73f041ba669ce2184f6f471d5e3524efa34ca31233e9f5395262
- MD5 0cd8c971317d19bbed44757809bcb92b
- SHA1 47b15748ecc8e952c5935170090db7c269ce4b4f
- SHA512 883dba84bf7daae3ea49f9d54c13dda4f125da82ba63f90eeba0900602896ad9492a0adf7b69b67d838034090af20926af5c2934797afaadb38aa069786c1fc6
- SSDEEP 96:fijrkiK5k5LPXbac9m5Lv6FzSvd4gIRjETUT200qSdvabvDIwQBugqvA:KjrbLPD9sLvIzSvKgIqUEa2
- TLSH
  T17FC11245B1C09D220BF3482DE6527988F7A8923B0235AC54B4DCA61F5F73C85A7B33B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  cadencii-master/src/ScriptImplement/UTAU Plugin Manager.cs
- Size 14KB
- SHA256 45bf455848e9afaddcfbac483e9fdf4dc82212955793e0eb9568a397d4cbb9c1
- MD5 35da138fb95f936f225b950369a52549
- SHA1 245ee77c6f5d99b709c1810a364454fddad1d536
- SHA512 7563960ee34924860d6901c0d28c5af7c8980a73d5aaa187cafdadc5bbd549199ed8ab89cc8bc9a3decc59c664e06a10589bbabf0925927c29eeda13f715dda4
- SSDEEP 192:YKMOUHePMaB37eUhvTQ2eGXM0eUeESlyY1G4aEB+wn7etjZBP4t5kwX6zHIe0nm9:YK6+PvTQCMpEYd3BT7q0mIe0wZgM
- TLSH
  T158620F6A574F854248B6333ACF5A5AC4FF79063B970A94147CEE4588AFB24394370FB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32