03a2dca2d3ada728ec5940bdc62dac20b854beef481c6cf345e5df183452d248

Sharing

Copy URL Twitter E-mail

General

Target
LCEMP v1.0.4.zip
Size 424.1MB
Sample260718-fnfl4sg12k
SHA256 03a2dca2d3ada728ec5940bdc62dac20b854beef481c6cf345e5df183452d248
MD5 89692f9d17795bbeec831d21d8196de9
SHA1 f3803440ef4d95675ec8cb42604fbf8bf442d35a
SHA512 2bbfd8f052acdf0d7207b9354c906fbae8b8a84e334ab5f91ae42288cffc5b41350a2a1a432b3533beebb94ab65c112fba2473d268bdf9ffc6cf020ca4f47220
SSDEEP 12582912:20/d+YDJv1X4DGLH4rFlZDg0OcKyuOP6x:2Y+Y8Kj4rZDgqK1OQ
TLSH
T1592933F4CEBE4D65C17D603081D64912BD4B575EE0B2A770B6807CE482D398AAF6B378
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  LCEMP v1.0.4.zip
- Size 424.1MB
- SHA256 03a2dca2d3ada728ec5940bdc62dac20b854beef481c6cf345e5df183452d248
- MD5 89692f9d17795bbeec831d21d8196de9
- SHA1 f3803440ef4d95675ec8cb42604fbf8bf442d35a
- SHA512 2bbfd8f052acdf0d7207b9354c906fbae8b8a84e334ab5f91ae42288cffc5b41350a2a1a432b3533beebb94ab65c112fba2473d268bdf9ffc6cf020ca4f47220
- SSDEEP 12582912:20/d+YDJv1X4DGLH4rFlZDg0OcKyuOP6x:2Y+Y8Kj4rZDgqK1OQ
- TLSH
  T1592933F4CEBE4D65C17D603081D64912BD4B575EE0B2A770B6807CE482D398AAF6B378
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Common/res/TitleUpdate/GameRules/BuildOnly/GameRules.sln
- Size 1KB
- SHA256 0f3a0aded9fba10e967bfb08648413958a7bdfd81aeddd258c55702e900fb682
- MD5 d1f8ea0c482a2c91d1ad717e94e020c2
- SHA1 be8e437eab7e4532d596269824bf185d1fb4e9f0
- SHA512 087f82ddd17caa6daa84ee7b9a36d59f862d542614154b1aa49f9922288daaafd7e74579c6eaa17f6dcef18c9e7be773d91885f45783100d56b98c84aa2c1723
- TLSH
  T18F213AE8512E21D1B149137FD1A30C09EB33A6C587840ABCD45698ACB76BE92C34F4AB
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Common/res/TitleUpdate/GameRules/BuildOnly/GameRules.vcxproj
- Size 5KB
- SHA256 610eb71084b52aa338dbb9e27c10d1f5be0dd7fbc66a1aaee0937d8df319f8d7
- MD5 a15df48032839ccc87642a3d64d9e7f3
- SHA1 57bc2be951c2bebe809641ed669d7231ae7ec982
- SHA512 ba584257deaf1d51c602a6602ed61913b47a82e009c0505aac1a6fe046608e045cf2353723dc5607d53bfac36029e2250c08daad5687bf6742a1444fc663bcde
- SSDEEP 48:32uKyMS9M0Zb3aqlQ2efH6owIo2eriN1M2JaLviNzM2JaLvIV7NwrPJp+8XkCKY5:98ellcf0LyaLByaLOnFEG6ElHe2bC
- TLSH
  T171B18CD4E0B8CD0761401737C292EA006E14B7C36E60557CF28FABAD9B97A4863177BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Common/res/TitleUpdate/GameRules/BuildOnly/GameRules.vcxproj.filters
- Size 4KB
- SHA256 962706c59b84c9e689ebe3cc26a719ad04eef039bfa82b1b8e2938ad22428df0
- MD5 713d1d713b9c42c81210eb6deb746556
- SHA1 500697e5dd9817518ecc3505a322d5a096876e43
- SHA512 87902d3a61c65282e80396c018394ba78593773b49b69f4e7daefe89077ee9d1b2cabdab6e7ec9e5be16fe335f0f28dab02a14bb72a7e0e74b81d2ef681bfd8a
- SSDEEP 48:3dKPAJzIZuAppPDqEBaiB0iBoiBaiBpiBbiBMiBkiB/i/boL86AYh4LLAudR2pPL:tBkk8as0sosaspsbsMsks/Q+
- TLSH
  T1619189A4D0F8CB8761211E5AF600DB416D14B2E3B858B22C72DF859D6BC7F06A32756C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Common/res/TitleUpdate/GameRules/BuildOnly/GameRules.vcxproj.vspscc
- Size 247B
- SHA256 4f9bbf63b8a210891b95914b9acd602a183aba262b1181c7c79209a7263af10b
- MD5 4e2930ad202419c81b6ca1d26884e78d
- SHA1 85ff3795e43f057bfa65cc4f72aa85ca3a7deff7
- SHA512 45458875628c8ae94de94b4e0b6a44eb9db6d8c53319dc226732bd7efde0ee25aa302822afc33a31653d60c3a7162a294c41ba1e41c03ba1d90e06e037e0b145
- TLSH
  T1CED02B18559D0F5A94017D6A8548640A54A82358484C062C68EC7C3CE0BCB444DE4713
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Common/res/TitleUpdate/GameRules/BuildOnly/GameRulesDefinition.xsd
- Size 93KB
- SHA256 9c1568daed3d81f759205f9573cc9abc7a21d39cbb16db06eab1a207f9286a2a
- MD5 b953766ec017dce49d86e54f43b0e248
- SHA1 83841b4ced0735269e68ad0e663e5d6c9295d1fe
- SHA512 bcd7c33b97f8849865ffd92bcd98fbd0016de10cf193c82662695898ccc64f9236e93709f2b753323b4fda515b38891b04e7bd6104f68448b063751d9d96e828
- SSDEEP 768:vp7qTjyHayhyHarhRgEFImirtiGrDnx5od3LGsRDGsRao:BamipiGHnx5od36sUAV
- TLSH
  T198936BD419F0E4F11C4B142B32726458DEB474A7F5A5AF4AF48C4AB2DF10C2DA39FA26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  Common/res/TitleUpdate/GameRules/BuildOnly/Tutorial/GameRules.grf
- Size 95KB
- SHA256 934f8100eafccb7d75cec4e99f051a825be658417503d12841954084883c0b17
- MD5 21c9ea47f696100a066987503164bf7e
- SHA1 4b99909b4fa5558cd1bae0e1aaa2a6a53084943a
- SHA512 487de6299f0c2fea30c0e201ba0131734dbdf4163bd24946947a5406d563cb1f815a411668992a4478294e31a534fb327d5cb83040933d516ab7bcbdbb5ab7bd
- SSDEEP 1536:+xg70vAyeXGwBzg1MKPGciv1JGdtJHch3pQyry6PLxCRgOXzWwyalayIQCdezI+4:f78AyeXDEu/BitJHq5QQzd5NWzIxz+89
- TLSH
  T1D7931217A71F67205290BBA0BB2F65147149CDA281360F7407A776B0EA0654BFE2D2FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  Common/res/TitleUpdate/GameRules/BuildOnly/Tutorial/GameRules.grh
- Size 267B
- SHA256 d95a211325aa7e69dd954cb71b8fd25adae9def94ec4a1204a58b7cc8ba5b0bb
- MD5 3d7c92c57563d5bb29285a8410036d2f
- SHA1 1d07d13ce715f54c65e245486f25e1fca7356b3a
- SHA512 0f501db1e69665215b0867ecd075768955f923d7e276d167fd3174edf5085cbe34d9ae959243b716fe35cacd73bc48ba2ded5c60842e35a66d00a0f94bcecf9b
- TLSH
  T135D080452D50873DD15C17B92675155DD7749D04F54A1127E74500433C6265C7D79A10
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  Common/res/TitleUpdate/GameRules/BuildOnly/Tutorial/GameRules.xml
- Size 44KB
- SHA256 3cf2c708a52c02d83300e3363e6dc03f44e410c485de8120705765e1f1de5d5b
- MD5 da5892fe5c8fc1fc2ae05e497b49fb66
- SHA1 d7b6c9da174791f05568b03f3e1ea664128c0af9
- SHA512 070e87bdc3b8a33358c54323283a528ab89c7c16751271be5575b751d3fa63e60814ceb8d88a67ad80cd3863fa130d2e436be677b4f1ede639bd7ba694d24770
- SSDEEP 768:kc8ajUWEdlaT3MECrBOkQCZVVVVVVVpA0Lm21NZ:18ajUWEdlaT3MECrB3QCZVVVVVVVpA0N
- TLSH
  T1A8137F235ADE5409A2B31608DAB685224AA37C13093CCD5D42AE6D4DCFE7F835913FE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  Common/res/TitleUpdate/GameRules/BuildOnly/Tutorial/Strings/Microsoft/de-DE.lang
- Size 137B
- SHA256 e74abd7abe8e020d3e11459b67537917a36cd0a424d22753b308bf94fe8fe63c
- MD5 f2802b236e0ea0d47f41730f0afdff6f
- SHA1 ba8646230bb104e81a3e29cd9237be364ca4b285
- SHA512 04fd4831a6688544ec55963a9b1e7c3693df6959c01e0ba956dedb521f38986dc7a475057cbeb918b217efdea2689df789bd81ef10e03bb84373f317eb5ae256
- TLSH
  T1F8C02B49F34DCF0DA0B22A31CA40C8002172F012101D63D0C0C8B17B2F09E491C35241
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  Common/res/TitleUpdate/GameRules/BuildOnly/Tutorial/Strings/Microsoft/es-ES.lang
- Size 130B
- SHA256 29f0fb050bfd5b5132cf4c027de57c9defc32cccdca3363899665800954acc97
- MD5 6c48346b70150306c0202b44e7abbb89
- SHA1 f76b8ac1f2b610ee1a9c4dc4fe2898a6a4cf9025
- SHA512 e05a9a2c1aeda84029cd90c4b45e6b34d5ae6ad61fb00ca8f708aaf924ce0913ecfc38612ca074f035989c07369affb16f6a92be039c50113f35bdd736fd3efa
- TLSH
  T143C02B0CB64AC709A0D024143900C800324170710349E3913084B20E3F0C9419A21270
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  Common/res/TitleUpdate/GameRules/BuildOnly/Tutorial/Strings/Microsoft/fr-FR.lang
- Size 134B
- SHA256 e9013fca44687f3f1d8f9b25644a81dd1813db324f64579a20440b867598cb99
- MD5 c227fb01c6dfd3a84035ced8821893b3
- SHA1 bbcc7438be21ae42fa0c74aa9c370a4813084eb2
- SHA512 1fdff6c7bf1a82565cf32df334c98adbe58e4b5d8fc8e1cac9d5b0f3f992d5c2b771f976f25d9106c9586554d9a16b5092cbd5c7d36fe406f1c939430b376552
- TLSH
  T1E6C09B4EF28DCB1D607014194D94C45112513464515862F115D075AD7F1DA955EE5545
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  Common/res/TitleUpdate/GameRules/BuildOnly/Tutorial/Strings/Microsoft/it-IT.lang
- Size 124B
- SHA256 f9698d0e3d4e55ce6e9c657ad8a59765f65c5247fd12351b552cc70cddfc4dd7
- MD5 76a4424a43678bfb5ee956ba03f683ec
- SHA1 dcfc813803c0751cab1044675a233f1fc3fb3e53
- SHA512 0c8d57a9f92b489d3c6a7b6eca5f70722f4f9181dbe824c294d3f93a28771e0d25db196235ce992c8e9569f2c949ee05fb176963dd69aabe6d6d4cc4afd86633
- TLSH
  T168B09B59BB4D8B1C74D4543569518C1035927059125C73E13580715A1F099459E91254
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  Common/res/TitleUpdate/GameRules/BuildOnly/Tutorial/Strings/Microsoft/ja-JP.lang
- Size 143B
- SHA256 a94cce78764c5d3ed422c769cf2db0342888d3f4ab4885eb629ca1af4aa71546
- MD5 f6ce83edacc763913ee71e6449570730
- SHA1 0869e0e15fb9571f1cac2f8d61fbb0accc96ba13
- SHA512 497e422efb3b3b0095759bcc591db0c052db53dbb1a83356c8211cf2223ca2532f25b61df1d6c3a2ad0ee7ba4f74e710fc18395eef5c860b14b96e5578b7bdc5
- TLSH
  T1CFC02B0DF388CB1DE15115354D414C8023527C27E254B291644DF24B3F48845DC99050
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  Common/res/TitleUpdate/GameRules/BuildOnly/Tutorial/Strings/Microsoft/ko-KR.lang
- Size 141B
- SHA256 2d72ff13335301541f9f177d1ea0e3108615e5cfb6dfe813198496e23137d7a2
- MD5 605c36abbdc030fb532013a5d992a6d8
- SHA1 ee5b00a406d1423001bd7dfbf77f5bc857c58e5e
- SHA512 06dce7ae8658bb238543fdb1cc994ad06889da3167bc43b35a405f82945a2a65a71098277e2a06820cae02bc901aa03b0abeceba220fc5c5c0c1ab067be5bfe9
- TLSH
  T164C02B8FB38C8B2CA25055104F50D4102381702262A5E3D1D880F65A5F09C895DB4240
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  Common/res/TitleUpdate/GameRules/BuildOnly/Tutorial/Strings/Microsoft/pt-BR.lang
- Size 139B
- SHA256 364362bf5c2791c3d0e1b443460bca48da4c787d0a71f45b7ac0c3dbfe9dbbf8
- MD5 11eed769a5198d99af46931ba12d36f6
- SHA1 8148e7cecea4bd4a2dbad5741382c6f71a7dfcde
- SHA512 f9a24d14bb1002434c3105dbda9f2aece5c3cb1dc5caf1912f3e9554da42e6c287d1496104a4df447120ccc918038dd047dcff0a1591cba2d4028ef9052c1c38
- TLSH
  T11BC02B4DF68D871C60E030256FA0C8417251B0112158E29114C0F3393FCCD02EC17360
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32