73bd687e523f56771a95a200b501d606f17cd277c255d8be9d07404cd41546cc

Sharing

Copy URL Twitter E-mail

General

Target
EdgeOneMore.zip
Size 144.2MB
Sample260718-emcy6aaz4v
SHA256 73bd687e523f56771a95a200b501d606f17cd277c255d8be9d07404cd41546cc
MD5 ee4de28f2d082f9e91b896072112c878
SHA1 5e10180668f3b1a629aba66b958f817d8fd2805a
SHA512 6eccf7e531a081fbe393754ee35f32c109ab7f5916a67e12cfd331f6d39dd47890d036643f99a406b2c6285979c337c21fa955d9ce2a7241cd14d2e4e7cf854c
SSDEEP 3145728:o0W+11DrS7nK5Wwccm6OrS7trS7+nGwye2o21euXqRIj9ZamC6M4G1F:o0h+K5WwFP0aTSdXqSxA8GT
TLSH
T12A7833E1F1496955CD2F12F5A2CC9D90DBC1C3EA46152F48A33253112A9F298EE3BCDB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  EdgeOneMore/Game/data_DomTest_windows_x86_64/System.Web.HttpUtility.dll
- Size 58KB
- SHA256 51f26603f0a50324e3875a3711ec3018d68477c121c34b315a2b7778cdfcf35e
- MD5 a6a2eb0d3d9f8d10ffa981cbe02f6add
- SHA1 64e46f37bc37b47263a210e1b662de528c3337d5
- SHA512 474ab34f76a35f421be3d18dccdccb86c4f11fd1f8ea662c04c84aed772d06f56a10914fc0f7a6dd4eb8551c34b679bfacf0867fa70065c6a72049d5b34fc987
- SSDEEP 768:BeSVA91ACQcmHLnDWrdg7JvYJ2QWMVkDOBM7dWs3DXfXSXEW/2dXjQtak9z0:BZA/kcknDa2tYmwkDmmwWDvCT2hQcMz0
- TLSH
  T15E437C09AB888010EA69817D8567EA63F036FEC65312EACF59CCF7861E733C1D375066
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  EdgeOneMore/Game/data_DomTest_windows_x86_64/System.Web.dll
- Size 15KB
- SHA256 a6c9fb893d65dc8498720719d4bccca5ae271da58c0c84a39d6039ad11534247
- MD5 b37121a870104037962b842020f82421
- SHA1 935ea9a83b221d657294513b238efbbedef555d7
- SHA512 2b8c1ff695350ba437b8ba91bd242b567307dfa0797c325ff1bd9f47757ff03f1ad44f75abb38b09977e1087dcc726a150e8afe665d88b73e07f1e512ccd0b42
- SSDEEP 384:PTLha2NWVvo9WTnfLXmztvGHRN7QR7i1R9zA5H7:PTtaoInjQtaQR7in9z47
- TLSH
  T10D626DA587AC4203EEA65DB052FADA473C3C63C39A51956F16C6F7481863384DF3072D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  EdgeOneMore/Game/data_DomTest_windows_x86_64/System.Windows.dll
- Size 15KB
- SHA256 1a3e2f10ba58873241a38af977b40bf7fce9a247282152b5c1f50d6c419da54d
- MD5 06fb0917d455e1e70eb7575db037184a
- SHA1 22028634c799224d039e87ab75a09c698b73fe66
- SHA512 8513bff9be40266b252f867b4c9e6e1375f81632b074fc4739276aa171d15355e395d7cb09ab01c4e8b8e7ae4bafc143a6deba22dd48adc3dd9db95d611c3cbf
- SSDEEP 384:TaHtpnEJWElSWTyqwnHRN7TgMskELRPR9zPpT1:OP+ynXTL3Q9zhT1
- TLSH
  T1BD725CE197684103EEBB6E7092A9DA433D3C57D34E21962B1682F94418633C9EB3172E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  EdgeOneMore/Game/data_DomTest_windows_x86_64/System.Xml.Linq.dll
- Size 15KB
- SHA256 25a26b9b0f56ccc4b432145234de35a3191ce3e4e91c87ae6a15f49b858e13e9
- MD5 fe19b212b3c68d22a92d5bf064d95c73
- SHA1 b9c79bd62f8a157ed6f6b41e674cf5d914424992
- SHA512 668eb17f9b01f1fd0290e3ee5b47743134335e866cf8cd123cd8710a94b36918032304aca30b86dd5456f127de5a24deaca8c377f78b5f6e486e2c78d26b26e2
- SSDEEP 384:WkhrW1H4W+fLXmztvGHRN7goJR9z7Lmk/:WBAjQtaf9zmE
- TLSH
  T18F726F9557284243FEAA1EB053E5D1433EB897C35811DB7A16C2F6481DA33C5DB3072D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  EdgeOneMore/Game/data_DomTest_windows_x86_64/System.Xml.ReaderWriter.dll
- Size 21KB
- SHA256 a601050225abae9978febacac35356f9b29f9c38dc3727283ebea9f7f7e3cb7d
- MD5 a4592e15502fd26629fa2b60b5f90771
- SHA1 af1eb721adf2214f1b110a0fde6ac029b06b0a9f
- SHA512 dc2b3ec81dca0c39c74fd2a93132bf78759ee994ae4983ae838362ae29e1880ec37d2d3b6734db20cc7ac8c79f2c2708c84df9ab68411455e8a73111b775285d
- SSDEEP 384:is1G5qkxK67ex4FCHRVSW1/AWyfLXmztvGHRN7RNQDtdQ5R9zpz:t6LKzYjQtaRcds9z
- TLSH
  T1A5A22AA1CD68CE03EDAA7B70D6AFD4C33BF4629124319B75D586E50B4493384AB37318
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  EdgeOneMore/Game/data_DomTest_windows_x86_64/System.Xml.Serialization.dll
- Size 16KB
- SHA256 5845964506036b0225e2c6cef02ea34e2db53010bba42bdc2ae525f0e985c0cc
- MD5 29b5ccb82a33365c3c8c1afc7c1976c0
- SHA1 9f362cbde1db8d191797ff74f3b7513539fec017
- SHA512 e7b6f475ad68514540d9bddc652bb47e63db80ba4c210823c68eb4bf55ffb44811221f22e067fdac3ff2935f23e485288cd238e14f4f2e4e91f03d77b89f01cf
- SSDEEP 384:KIZQLW7MIEqHWrfLXmztvGHRN7WoYlORR9z7:KIGk7EqAjQtasK9z
- TLSH
  T1F4724BAAC7688223DDE61F70E6A5E8433C7C57D76821CA261592F61A08933C9DF31B1D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  EdgeOneMore/Game/data_DomTest_windows_x86_64/System.Xml.XDocument.dll
- Size 15KB
- SHA256 c2492e8c803bea2731620896c578df5047a1a1d9ca0c56e351ca0bcf5a86858a
- MD5 31bc0b1a17bc0fd057dc1fd2544acc46
- SHA1 572c1e91225e30242102100322da44a57b9b493e
- SHA512 0f12b5981070a1b27b3c349a9f2a795a6e7c414efa365ed7ae299f19fea076306d2d68296dabcbd18039bce16a95f5716baac82dcb646dec1a4bc2f6e44b1eba
- SSDEEP 384:gaS4ewW/QdWcfLXmztvGHRN768KER9z7E:chipjQta68R9zg
- TLSH
  T11D726AE25B5C4203EEE75EB063E9C6033E7C63C25921DA7A1681F6891893781DB3076D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  EdgeOneMore/Game/data_DomTest_windows_x86_64/System.Xml.XPath.XDocument.dll
- Size 30KB
- SHA256 712569ab030e0725175b88011cd4453d73bece0c92386600bdac9db99208793e
- MD5 39b5f0a2982195c9d521730b67297a62
- SHA1 080767d9e81096078715068f994ca3a7c7516c66
- SHA512 5594ba0c17102f03c7e280844a4f5de060ea6e702555663242e658d961cb32d1a5a5c1a90cb255decb5e70bb1d880bea3605ed1ae67fb454907257b0dda3b969
- SSDEEP 384:XW0heW/BkrH7fUDfLXmztvGHRN76sR7i1R9zA5CJ:R/yrTUjQtatR7in9zJ
- TLSH
  T16DD26C7697684703EEA65D3062FCD6433D3C97C65A01DAAB2586F2480D53785DF3067C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  EdgeOneMore/Game/data_DomTest_windows_x86_64/System.Xml.XPath.dll
- Size 15KB
- SHA256 bb304fc568da5c9179fe79b6b9c5492995001eb025e2b9adf2890034c6b1afd3
- MD5 fc92cc247d31e0477752125937822de4
- SHA1 33be26722cc49e4f870e4434bd2ea9611de89fd2
- SHA512 2fc519aaf9ca12ff880f4748911a096aa1e3be11cbd3265cd7c9052ab83a624add847e04c755cd2cab5adfc34fe76a5c6784ac70599fd64a940935856d1f9819
- SSDEEP 384:09xLiAOgDWB2vWZfLXmztvGHRN75ZNviCksR9z93S:SdOMyjQta5/io9zlS
- TLSH
  T142725CE193584203FEA74FB1A1FDEA433D79A3C69920D62A1785F6441893384CB3576C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  EdgeOneMore/Game/data_DomTest_windows_x86_64/System.Xml.XmlDocument.dll
- Size 15KB
- SHA256 5f7645508aaa8755207365c834a5eb1128aa4be5eccb838f8921a145d07c9b86
- MD5 5a841ca8d8f39c6c4f7889afd27d8eb7
- SHA1 c76dc31147bc98c1040f5a7ae3d2a15606dc8a11
- SHA512 b978744da1c5fae2a8b3af2413e3aba402d413c862c09e2434eed6107f66448dac7f0504b6be8eda096289d18f4dd22f2d3b4cf20537d0946dea78af889e9d04
- SSDEEP 384:kTvoG64iWe7sWwIBwnHRN7HXYlORR9z7KVyO:CvoG8JeXHaK9zI
- TLSH
  T129726BD2C7688603FEA61F70A2FAD5433DBC63D2A921962B1592FA0518533C5DF3172D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  EdgeOneMore/Game/data_DomTest_windows_x86_64/System.Xml.XmlSerializer.dll
- Size 17KB
- SHA256 61e4030821ca7c55eb4a2ecae5ebc45f23710dfc1b59a0a7dde3cce23e8afe93
- MD5 c3ce661af282678acb723fda5f67a6cd
- SHA1 830e6f296a3c06bde5a724e89bb5c0cbb8ece531
- SHA512 fcc8f9a530dce24fcd66275e34eac90999317d60dd96aa45fbb0bd757c713fa3c30147369cad8359dda2ef00a48c4f1a220d1a91ac507440f6a43504cdde5a2e
- SSDEEP 384:w3oSMRWp2vWHfLXmztvGHRN75R6R7i1R9zA5:w3oSMhgjQtaj6R7in9z
- TLSH
  T1BF824C75D268CA13EDB61F70D9AAE9833EB853D368318B79115EE25104973888F3D72C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  EdgeOneMore/Game/data_DomTest_windows_x86_64/System.Xml.dll
- Size 23KB
- SHA256 b0ebf7cf7fa07f02272d97064f4de42582d18cdde6a72d179591b8e71914c42b
- MD5 0d5f3734afa040da81741779e81c0050
- SHA1 9156ce617922ece534ebdd13a73c398aeedb5c95
- SHA512 6ac74083303da5fb391b24dd525edc8590b4fcd5f7d1bf24891708c91d01ddc1bf6114ab1e0c436d7587495ecfa5983f76db72e1d97f0d51a83e8ba66be89513
- SSDEEP 384:b5FIeq5ufyw8bcB8yG5CMWKvjsWPfLXmztvGHRN7BR7i1R9zA5WTf3:b5FIeWv/JjQtaBR7in9z7L3
- TLSH
  T1C9B20AA6C968CF17ED5A7B70E99BD4C33BF4629A20728B71D481E1274493384AE3371C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  EdgeOneMore/Game/data_DomTest_windows_x86_64/System.dll
- Size 49KB
- SHA256 4262f07a4bdbac9e4784fd77cd2111cec768dc2826de20369dce8d960961a3b3
- MD5 c83e61b596b59259ffd726b1b7439aa6
- SHA1 27593bbceb83eea0eff22801b7a9619c207d9c59
- SHA512 0b5ff5654b1ef43d9b7ffdbd7c1c4879c67b3c3e0fcb3cb823021534e997a6489d4c5a6d1bbcaabf5e1837fc87c94986723dbff8c78746296e18325c7eb750fd
- SSDEEP 768:XOlKhT46UA2Zi5wRNH5JVb0U502zq1Tntuu92X+FK9zNYt:eu6Zi5i5jzCkO2XDzC
- TLSH
  T169332836A186E772C9CF9779FE5B878107F943D32071097A19D04581EBE3BC086A636B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  EdgeOneMore/Game/data_DomTest_windows_x86_64/WindowsBase.dll
- Size 16KB
- SHA256 79ed79fd32b7a0b5da1cd747aa52514670d785ef2fb8277e8cb3669aed2df250
- MD5 33596defc3c0b51ddaf36c486de92fc5
- SHA1 b8eb853a429ac24e178e2ab1be44a0ad10926a4a
- SHA512 ad38a14d472094db1628b6c318cc9f5d8199b67fd08cf2196771e53144bde2805c0508ad87121a63994fda9ba5f47b4578556811176e7df4d3277e486a07b865
- SSDEEP 384:TasFWQo6dWVrcWdfLXmztvGHRN7kSR9zZ3SZdXo:OCoLjQtake9zxedY
- TLSH
  T1D9724BA7AAA81223ECAB5E7066F6D5933C39A7C36C60D46B0682F6045C53391CB3172D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  EdgeOneMore/Game/data_DomTest_windows_x86_64/clretwrc.dll
- Size 303KB
- SHA256 28ec03548fc9b78f0e1195a57a49e6947329d682fe5e9b080f065e81dced30a8
- MD5 123361ab6a3dcae5fcd5fce2e6701834
- SHA1 8e33450caff93c321e84910f95f9139b1879a022
- SHA512 f672a441fdf6274c8df46ca0e9b5857b594bd325dc41cc9e8497d3f4ee09c978dbf5e99b7f7faf168c9cf5b8e2ebca360c4c764931b0d0c979e59bfb6070e08c
- SSDEEP 3072:VH9XK6chFjbdP7oCE33XfQIBchLZtfqYZdUpnb:rqn7fqYZdU1
- TLSH
  T1766488053BFD4409F5B75FB0AABB9235A676BCA52A51C41D2054D22D2CF1F80CE62BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  EdgeOneMore/Game/data_DomTest_windows_x86_64/clrgc.dll
- Size 653KB
- SHA256 61f0a9dd9907f40775ed19212c57155ac648875b93982c7cf21600a145789a37
- MD5 a03a2722e7ebae1c44d5d97bc2261e7e
- SHA1 a4029ca38749058a23730c4b29a7612a5d423436
- SHA512 77d6d189aa292f4a2df37769971f049cea0b132e84d2fac80f94d2d6916e378e502f0f05010e0379d97747d7419a8829ec3361b36e1cbb252d8f67dc826aa3d7
- SSDEEP 6144:PpV6LR7il5h7Lma8aUj/PupDYsEEmLUfEc1V9JziROUaVKEn2NiZVOBZcgyWjDGL:sinhj8aWbscUfVJ+ROnzn2NHZnDfZLhe
- TLSH
  T19EE47C5EF29D609CC527D07E86AB7237EBB574091B0179EB07A487206F67EE05B3A301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32