864ebb0af68a9fb381869cf5108536ef05fac6ae4791c7ce60bbf53d15af3d86

Sharing

Copy URL Twitter E-mail

General

Target
864ebb0af68a9fb381869cf5108536ef05fac6ae4791c7ce60bbf53d15af3d86
Size 1.3MB
Sample260719-3msxdaa13z
SHA256 864ebb0af68a9fb381869cf5108536ef05fac6ae4791c7ce60bbf53d15af3d86
MD5 cb44c330c394c7beba4c834c06ff6508
SHA1 41c71f0554fcc26032ce52c6c50868339590d554
SHA512 8e8383c259beb34a0dffea660b7abd6e2a7d7a97b0300291cc74f8cd9913152bbcb26bc23e10873aeee2ea3ab9664ec26ef88647863ffcd77dd320bd87a2dfc9
SSDEEP 24576:C0aSvhZfzbH6TtTsUtmA0UJJHTShPk5D5Byquf/q4GcnxMKbvmJ76kIkVQeYrV:Csv3yTWUtpTYk5D3yquqRcnReJ73kea
TLSH
T1155523938B398437EA4145BC79E1F94F9C7EB646CCF42A0393234646243AFD28D9E719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  864ebb0af68a9fb381869cf5108536ef05fac6ae4791c7ce60bbf53d15af3d86
- Size 1.3MB
- SHA256 864ebb0af68a9fb381869cf5108536ef05fac6ae4791c7ce60bbf53d15af3d86
- MD5 cb44c330c394c7beba4c834c06ff6508
- SHA1 41c71f0554fcc26032ce52c6c50868339590d554
- SHA512 8e8383c259beb34a0dffea660b7abd6e2a7d7a97b0300291cc74f8cd9913152bbcb26bc23e10873aeee2ea3ab9664ec26ef88647863ffcd77dd320bd87a2dfc9
- SSDEEP 24576:C0aSvhZfzbH6TtTsUtmA0UJJHTShPk5D5Byquf/q4GcnxMKbvmJ76kIkVQeYrV:Csv3yTWUtpTYk5D3yquqRcnReJ73kea
- TLSH
  T1155523938B398437EA4145BC79E1F94F9C7EB646CCF42A0393234646243AFD28D9E719
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution persistence
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $TEMP/Group.dotx
- Size 78KB
- SHA256 eb59802974d5fc3ddd1f60f53b6eb922581ea5865471e3c528b5a958e650032d
- MD5 642417ccc88b898cf37d6864c8160aaa
- SHA1 c31e56393e540e36d1705bc41b02461c9a9211b5
- SHA512 7f8cad91a2bc2277be88a14c9a06f649abff4f23b8b22c7db451b09c24d243596b415ed4cbf80ce1f86659bfd2ca7d163ed7da0635a240007c13e9cd86a69a2a
- SSDEEP 1536:pwq+965fCkbS8QvND9YMUqI4DOD82jB0L48cUqv2Eglm8pXu:pwjgZbKNDebqIA2j6L1chgmL
- TLSH
  T11D73027E63EF1609B8B0B3C4058DB8A0587F8C5ADE1BCA097ADD1E03E3959B6606CD15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

persistence ransomware
behavioral3 behavioral4
- Target
  $TEMP/Lasting.dotx
- Size 79KB
- SHA256 95df1438a00a78f89df33dd6e1b83d8454520173efa0f9e0fc973e2bb13e3c03
- MD5 59f9bb25e464715ed1f6552c9d2abb8c
- SHA1 ed422577a8b39920c4b3a6f17588710598a83634
- SHA512 431d3804a2147efcbea793ee6635d474049e142021204b2e13e769ac578ec2da03f37e02ab045b66dafd67a136b714f0053a2411ed6577fea379ac4a135560d3
- SSDEEP 1536:hMlE2LwP+VDHyElbJtiN0lmLzLKwJBo41AExwH:hMHLJxHyEtNlgNJK41AR
- TLSH
  T15C8302362F4C04D65A72B80F1D3D54CD9886A3B1AA4A7B310D7076E714B81E24EDED77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

persistence ransomware
behavioral5 behavioral6
- Target
  $TEMP/Publications.dotx
- Size 82KB
- SHA256 26745781214cd477c587adc4c83f3bd9bc4650dc4204af8ad6fc2041323d04e5
- MD5 a31b449f0287daee804c7b1b0f5d8b54
- SHA1 baec137fd9d7d2eaf1e84cbd37c685010fee12ba
- SHA512 e963d4a5bdf4de7bee7a47f1f0c96888bdfd172ea2da43b2736069c630675b0f917f6bd8de78081d4d202c65e2cf685e075220518d399508cb8b09f53b43c03d
- SSDEEP 1536:eWYzt48fl/WYv6umq0hdl794VBMXhVWIxyM9xmG9YovMuxVQlIyF:rUJt/WYv6dzmBoQPMzYo0iS++
- TLSH
  T19E8312217742571001AAFAAF98642F5DC75DD283A6E719CC0F383BD8146E9F99B047D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

persistence ransomware
behavioral7 behavioral8
- Target
  $TEMP/Suited.dotx
- Size 74KB
- SHA256 e0de7776605aa5b9884e48c2ecf2e817d0b1f8054199b6a3546f7d740437a4f9
- MD5 de8412b997ea649c1d3905b44144f3a3
- SHA1 c7bf7670268d57055bb1f09fcd76ee90e21b8e5b
- SHA512 93c1e5a996f6fc6c4e1c2ed80507091ac15ee8bcd83176f62e62b4bf5b73eeca4764260f88de4a109f80de5409c0269bb1c3f3cfec486e9f05e338d949fab04b
- SSDEEP 1536:JUaPPQ7Ckalgfwu8BE1z42fkkLygMgAE09OeLIM8zJ6RJ30L9ONXA6awfkmU:SaPI7Ckegfwu8UcYR+E09dLi+k0NXA6w
- TLSH
  T15D7312C8B2B4201768896ACF71635E3B884F30BD24E7CB589525B7EDBBC7152C66230D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

persistence ransomware
behavioral10 behavioral9
- Target
  $TEMP/Swingers.dotx
- Size 89KB
- SHA256 af10ddef22e883741b728a62edb15ea6dd82f106dac50c8ecb81c337e10e3573
- MD5 634bc00ac659b7c6b25eb54b56cd93ac
- SHA1 e02e867bacf3542ec49299eadee09e6a9b55f603
- SHA512 36a8523384512fb0d954cb7697e0ae3b4b71f0f6ffedb514bff05c3478e682adf877599f40cccca36f58575cf5baa3278de3b2d6d6a1401749f658c2b8d7dc31
- SSDEEP 1536:jFrJFuChV1CiazaEqFUinmwv4o8Om4X5hcacAyjyqF2nHg/jfU27MqTwK1OfQUT0:jdJFzhV+uEshv4C9X5hcaeOqFYyjf3qm
- TLSH
  T18A930162292ACB4977CCC295F1933428C571E036AFF6B97798C509DB64D80540A3FF4C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

persistence ransomware
behavioral11 behavioral12
- Target
  $TEMP/Training.dotx
- Size 80KB
- SHA256 4880e0ef0f199c1eff7e1b8912f5831ed0f3090725113103d2d8efef45eca901
- MD5 a3698693bef23b72d0b636bf441ff9fc
- SHA1 c86d14d8806b25d5890194c49909e2261cf39e11
- SHA512 e6841ad405c0e12c95fa2b2f50e35fbd8308c89351758392b14fbafcc00af1063beffa3124dbbfe7663a7013480a0c140f86199acda79ba5f6701cbe436e73de
- SSDEEP 1536:SBMs09A3OfC24eCfnArYbvOL66AnXil3Hm+mQVujp743y:S49A1/eCfnA8bzPylDPVosy
- TLSH
  T13F8301457CAF616397BCE0A08C5E9A1A7A7D6DCB079D2A4D2FE72406CF8B8495103F42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

persistence ransomware
behavioral13 behavioral14
- Target
  CoalitionScotland/Bridge.dotx
- Size 55KB
- SHA256 7d7f9bc32a8bbb300de09c8c5eda88a35ff7a3a8f60a234f1c3220e4c82290ef
- MD5 3e70c0d0fdb062b5eb5aa4cb16bd1d3f
- SHA1 f4d4d1f8877779c7c084123689db20df17536a48
- SHA512 7ad693e42048e874ff99cc3dd6531f8d2c5e827a5ca3f0c5e2f4e44b43d645634eaed998444c7a8ba33fb1c5b05d6db51e5f43f7a69b88c1f7a6c4934125176f
- SSDEEP 1536:7RJav/M6EvU+AQ3uypsSIXeZzahrNdXiK64:mvu3H0eABy4
- TLSH
  T1A243013E8BBA5F4D930596061A2A9F3538D42CD218D47D30AAB3724E928D0DDDFA170F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

persistence ransomware
behavioral15 behavioral16
- Target
  CoalitionScotland/Comic.dotx
- Size 60KB
- SHA256 524a9f434fc3c56aa0cf52fcc4bbb541384c71e83a18c4b447fbf0cc23a8bb64
- MD5 01a85b0e07cffcb752aa61852e70e7ed
- SHA1 dbafa682066bd6888633b9b3f801fc122c8f45e4
- SHA512 b4661ceff4ca1a658f31fbabeee946695105b6cea85a7e9a76a5fc63aa4179d88bc9e51aca3a126f5b3478a33ae1787d6d9eecdc37a4877142bf19268da03c8f
- SSDEEP 1536:YH9o0IVCXwE8ml3Habx5NrKsQ0SkqGuGHkKo/:I9opKwE3Xabx5N2vJEkKe
- TLSH
  T1FA53029E613575091327146C52B5AA509A02838DBF8EF76C1844CFF3DFC2E611365B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

persistence ransomware
behavioral17 behavioral18
- Target
  TurningMorrison/Granny.dotx
- Size 16KB
- SHA256 154646ab66755cc14989f5c1a47bdf5e42919c99a3fc412449f0c517f545feb3
- MD5 5a45200c43dfd624b9d630c3e58af514
- SHA1 0f75889d40b05434d92e8209d0562f96c47699fc
- SHA512 d801bdc10decfd89adb24993362821dd8a4d5f3b387fe035f8a2f9570d12e9dab670f011625f856fb503af9a3818b7d65d1114f5c1128ba50e068418fd6b084a
- SSDEEP 384:W4Pw2fOk8LzkJASLddLCoo7zF2VZOT99Zcx6d95+OsY7KX6+apy:W4I2Gk8LzkzLpox2VQTOxY+NDMpy
- TLSH
  T1D4723AE83B941453998EB2FBCEE2854BBA33E1C0921D205D5E1B6B9C9105D4D233ED77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral19 behavioral20
- Target
  TurningMorrison/Trusts.dotx
- Size 67KB
- SHA256 b75cc526f47c58d9a154ceaa6339980a81b9d5247d248c77cce6fdc993d4c546
- MD5 e8f57c2457b5f8d109df5ff870461b2d
- SHA1 9c8ddbc946df73d1cfbc2ab8d67b5216de449cf1
- SHA512 329f68ccb0594855b18a2f08c5c31433726d50a6d829f2586ab72ca076704a9bd732e555758e60c1ed73b2a96696bf1148a50aa9b6efa79fdb77a3b4615ee08c
- SSDEEP 1536:GLN83kJ43P5NwS44aqtEWgIkJys0jrU9f1HauU6ammCu7:GJ6kJwPwS9tqrJyFjrUHzE
- TLSH
  T1C06302E6C492C9015815269D8D4C1F8C3D8566DFB26AEE871DC1DAFFFC004BE818F9A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

persistence ransomware
behavioral21 behavioral22