3ad3e70fd8d9fc676cd078030a1c7c16da8c4f5852edafe5a7cd90fff4392a20

Sharing

Copy URL Twitter E-mail

General

Target
Dvorak_Type2_Win.zip
Size 260KB
Sample260718-11ekssd15l
SHA256 3ad3e70fd8d9fc676cd078030a1c7c16da8c4f5852edafe5a7cd90fff4392a20
MD5 1c36103c7292701f42147b401dd89f93
SHA1 509fb4c4fd8ca11f19ae22bb32eab4d3177765f8
SHA512 c676ba7cf4bab46e7f9e24bf489e79b377b70c62e2d98614572d5bba664378279ea308761085ce91836338ebbb0169388dd362f03bff1befadda6e07d6c70f45
SSDEEP 6144:hC5CHj66BKrAegt8ONxrWaXlnj85iG8/1:c5gj6VrAeWxrWa1A5p8/1
TLSH
T1234423E5D005FDE8FCCBBA31402822C61794D2866D1BDA73A983D53C9917F49A31EF46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  dvorak-keyboard/dvorak/Dvorak_amd64.msi
- Size 112KB
- SHA256 ca601b31fc0df9e1dc67634e685e85620022373d58f3a8c577d7ea1fe1520869
- MD5 5a8ab341342070beb0a21ce6aaa85867
- SHA1 a4e45adaaee43d0148cf91a43cd5af5ad1788336
- SHA512 c10e7ab580f75dfcef7bdb7af3f9c8bec37833895c109ad623796b82df15c83961ba4c1ca832b49a5dc37d681d481f0e0a13cf43f6e4a8a7fb6e202384ca0865
- SSDEEP 1536:Wx8fEfvIjLgv/A+VXJ3lIMW10i2AinCNvy/Fae7p1:ojXIngv/ACPIMViRy/Ec7
- TLSH
  T1D9B35D0777048333D5C20232852FD7E19F799CA84B724513A19EB2AD2CB2BD8E6B75D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery persistence privilege_escalation ransomware spyware
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  dvorak-keyboard/dvorak/Dvorak_i386.msi
- Size 112KB
- SHA256 506c61a372cddc01468a41366cf6da6de200d1110ab15e234a1dc8a318130b84
- MD5 9a20cddb60034c5e9fa006262b2729a0
- SHA1 4c9b2b31a4af86fb6965e75b2deb35699a9f7441
- SHA512 dbd9c89f64aa609dd21214a5ac3ff4d4634b8b1ee947db7b706dc05579750eb7d30cb7f8cc1ab7ecac275b91778d615d71261ab4ea83e4ee4b67ff574b7b9e13
- SSDEEP 1536:Xx8fEfvIjL4vW5+VXJ3lIMW10i2AinCNvy/Faehp7:hjXIn4v4CPIMViRy/Eit
- TLSH
  T10AB35D07B7088333D5C20232452FD7E19F799CA84B728513A19EB2AD2CB2BD4E6B75D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

persistence privilege_escalation
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  dvorak-keyboard/dvorak/Dvorak_ia64.msi
- Size 112KB
- SHA256 2a2716f5f16b72e06600f727047f485c78d8d65d263b2c174f842716adab08c2
- MD5 2cd16dcd44a970704c323a43e5ed1663
- SHA1 ebfe73099f8ca27413493945782dc2ecf15dec26
- SHA512 226fe6e1c0220829e20a27fd73c192fd9c204245d2c2ae9f68f070b9f8ce8699816132ab54b6201b833097065b385fc9ac6f3239d006f2ef8f1194ebe7d0fe27
- SSDEEP 1536:Px8fEfvIjL/vf+VXJ3lIMW10i2AinCNvy/Fae7s:JjXIn/vfCPIMViRy/Ecs
- TLSH
  T10BB35C0777048333D5C20632852FDBE15F79DCA84B728513A1AEB2AC2CB2BD4A6B75D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

persistence privilege_escalation
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  dvorak-keyboard/dvorak/amd64/Dvorak.dll
- Size 7KB
- SHA256 9d31fbd02defd401e5d20c4bb17ab372dfaa2712e00feb5501d822aa8dd232f6
- MD5 8dd1e39e4795c0c0f7614bd329d0820f
- SHA1 47a3f40c53597943b90d1517ab3512eac5038801
- SHA512 7ed1dbbb14de1805f1c8f63c18c78d7f6cd42afc5c0f8a75d8b35ffbab19e52efbd4bd565808f63433a2bbe32a26e61f941276591565ea2a8ed85588d2177643
- SSDEEP 96:koDt6x1gjrYcEuyHEGA9QF7zufcl0Ghd1e+vP:kUt6jg4cZh2efGw2
- TLSH
  T1D0E11E40EFF4801DF1BFCA3848B71E6A6926F9224033CB6E1595024E5CAF7455F5AB39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  dvorak-keyboard/dvorak/i386/Dvorak.dll
- Size 6KB
- SHA256 421616aeab1513c79eeaeabac38eff9f012cc79f47caf6b387155aadf7b2f617
- MD5 a2faf36b0d4ac2dbdcec97853589b041
- SHA1 4d5c61fe482ef6b00ed33af7628df064f6bcb1a9
- SHA512 4b620f4fbf5e756b29daa7a300a4f71ef3accdc1cb7d0987545b8fc7a9e856191b12b71da8c1af41e7a5f8020888de0d2ac39d421c1d4844eba4deefebedfe2a
- SSDEEP 48:qg02f0+AAgync54arZMVcEjFzuyLT73Br9e0PdZFsN1rDE082Hctqsx7SsyEe1WF:hcea6cEuyH1s0PkVEm8d1een
- TLSH
  T114C10E40DFFA8949F1FF8B3515B5222A7826BC2194F3CA6E0581060B586F4419F1AF3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  dvorak-keyboard/dvorak/ia64/Dvorak.dll
- Size 7KB
- SHA256 fe14ad77fae2a0286c108b5f781e77b782e0c23c45907ed21d9872fd1e7a06fd
- MD5 790e1b171939252a188c2473667fe80f
- SHA1 0df7db659f339b2e4b4e4ce95f8f3845cc9e6137
- SHA512 5eb8da849ae45875e263123eb5f9b00a4fff38ad44a9597cd8f1efc2ac8b6cf640e760e61da0a8afe4c731deccc4a89fce7754672bfa255032eb2c539c8bc304
- SSDEEP 48:qyBcpk+AAgy3tI6r5MVcEjFzuyLTby1oQ4BfUlGt9xFzt6lhtlZthYcJLO0Hsc0y:tga6acEuyH217lCNaTfLO0Mc8d1eV8
- TLSH
  T1D7E10F40DFBA8405F1B38B3448B30E2A7A25FDA18573CA6E15A5024F9CAF7415F5DB39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  dvorak-keyboard/dvorak/setup.exe
- Size 139KB
- SHA256 1b3b4e920bebbf0b15bf7fbfc3f446e4322a6bd89d2dddaec64e1b1ebb675ca6
- MD5 c87b96c702b2ae528f71a6994e82ca62
- SHA1 226142ffb00f1986f16aedb0adc19df51766557e
- SHA512 caf13a6d6fad6935d3705371ff8d4167d6238785a07db38557e53ff1786e51492c1012624ef5445682ff206b67589db8a4e9f9c5a577a992a0246258604e2b84
- SSDEEP 3072:ezWP5D4zAed3ojyYKcJ3oUjoXper4GPT1Z/GdmkTdPiQV:vD4zAetUKdWoXeLrOdl5Pi
- TLSH
  T1A3D3AE01B3D4D139F4F72A72E57951B24B3A7C366F31D38FA304562E2AB5A81DA31362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery ransomware spyware
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral13 behavioral14
- Target
  dvorak-keyboard/dvorak/wow64/Dvorak.dll
- Size 6KB
- SHA256 98763086c0fd7e56624e16b372e55c7096e03deb88650bc586cfeefd062c1b6a
- MD5 39c7392f72703ec37d4d11b4d1a14571
- SHA1 6ddc447ff386652db0183532158ca109a89dd659
- SHA512 b9a47c4955d3b99c241003e7d1f8dd8c580afcf34b9e07b57b84d12a56ec26bd0a49927123b07e49c396023b18b05c51d5f42b2afcc2fca6df92eb632a9319dc
- SSDEEP 48:qwg9Iw+AAgynkYIoarJMVcEjFzuyLT7N8a+q7moWhJUn6Wcu1rDE082Actqsx7Si:Uu1aKcEuyHJ8xnoW86WjVEmrd1ee
- TLSH
  T179D11F80DFF5813DF2FFCB3814B6662678257D2294F3CA6D1191064B58AF6409F19B39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Enumerates connected drives

Drops file in System32 directory

Enumerates connected drives

Enumerates connected drives

Loads dropped DLL

Enumerates connected drives

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16