81995034a2f8070992ba1c48586b303ac89ca2a8b71db414a4bd83c79148ff0f

Sharing

Copy URL Twitter E-mail

General

Target
SETUP.zip
Size 25.3MB
Sample260721-kme2eabs3k
SHA256 81995034a2f8070992ba1c48586b303ac89ca2a8b71db414a4bd83c79148ff0f
MD5 ce75f4fa74fd9a21538c231240ae60dd
SHA1 8c92234c3f022b755e9bbacee997d0bc69f72e36
SHA512 3590964661392460e4984b5e479197a4916163880f416a7af9b6ee324f175595a283f00cf86938c48648d305eef357dc542488fe26a8cd42ee862128b1d454be
SSDEEP 393216:ovdif70vT/X0v5Wa2ozIQv0nJvN+z8bffXGrYnpgjvP/Z6k00LJ:okT0zX2qvfJvN+z8bfeUnpOvnYk0MJ
TLSH
T11947238BE1BE7813F466A67B51D72D2AD32CE515F273764B8E50120B2CC36450BD3B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Setup.exe
- Size 94KB
- SHA256 8c1b9b8e72264e27253a7cc14d6f9a560a127ebd9f8bcec81faba94710c19a47
- MD5 eba77a34e9b8aa78fce520d1431fc68b
- SHA1 215105e2640cd6da8adc1ea9ddafeb08c4d50f9b
- SHA512 fa66a42dd71fc862c218777b572f143144a7de0c5d8630061a554e6ebb9ad4557d810e7ca75598254231cb41dec2391c49a362206b8275742b5a5b92ee33417f
- SSDEEP 1536:ZaakYDoIhIxHHWMpdPa5wiE21M8kJIGFvb1Cw3/73sJxy+C:FDpSwMpdCq/IM8uIGfN/73sJTC
- TLSH
  T1A593D541E62DBDDDE508D4310A75E0F25E24EC3176C0A51EA7F37F0629726A3F90A93A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  XAudio2_7.dll
- Size 1.0MB
- SHA256 cf22efe33925eb298afe6947b514fa3a884dd59b048ffbbd92cd6ec494efec9e
- MD5 84459bc66cd76ecb56bf8195b70b93be
- SHA1 88e4682490d6beac5c7f16f9a3833877fc7bc425
- SHA512 c28da71646ebdc2df02ad819a1dde38842a0941cd0727d8c9ce9d29e59c6efc55278a6520f5b9f7173231b54af11b89fb0f959327e676f52fee606028808917d
- SSDEEP 24576:F98+hIBENODs/W9tzFvw0ka9U27xAgXO14YGZLAdd+66L:+ENEw1a9J7xgGud+dL
- TLSH
  T1BE35BF12A0418279C9F725F1855F333B67388BC4574116D753E8A9F9EEE22E07EB02DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  osprovision/autoprovisioning/osprovision.cmd
- Size 215B
- SHA256 03143393247e0488b583a8a6985403b62803acdeabfaee363dfc987c61ad1dae
- MD5 e05d4e7e114a84a8ff9287d056846ede
- SHA1 e71af6e6d0f119f7c8d3510ff71af994fc28daaf
- SHA512 ae30a3443549270917fb2e4b1b7ae498b068c7158ebfc43fd38573b93ffe677b6668fa5c0b4f39b3e301b64c7cc7d0e6514b6b2eef922afc2f136e340c16c7a0
- TLSH
  T141D022339127062A286ACA9F42DBA6AF617FF104208B3D99B2FC40F4140FE52E121D0F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  osprovision/autoprovisioning/platformtools.cmd
- Size 346B
- SHA256 619e0db7c7df9e0884fed2eaf0419873fb0171541aa3d9bbb72d3a83577eac19
- MD5 fe99928cc24483b57e6203bf9004ebcc
- SHA1 1a08499f5ec45a8eb1dd7f696a3ebc77fbbd3d3c
- SHA512 94762dabef9cdd0d243d3f87f12c86b4e251cd9d17ff88e2a98a5b773465b4718a186dae135630bbe534a0da847c63742f1954874ccd7d8880f3da81ba174abb
- TLSH
  T15CE0C0132143420F24018AEB4217DC956150F1472ABBF769F4FC50006029E42E07172F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  profiles/templates/StartingScriptWrapper.ps1
- Size 13KB
- SHA256 c67b8cc2af757b3ac17908bb6a4401f647d85c1fe52bcdecaff4f613d3837270
- MD5 e06d0ab3e6cb84e09450eba6815adebd
- SHA1 9b4687b51de5ad46c4957a6321745004dc4a39dd
- SHA512 52c055135bb8c3859fbe53887d3b4882549292c0115dad28990763f29a45857892f94993bec32cbdb412ecfeae7b6b8eda0b2897847b8a72c8ff3d812351134a
- SSDEEP 384:wNBk9t6/z+DS8pED8m3IwHkCaB8q8Fqm/krh+hEJ5jj:QBr+G8pEDz3IwfamFqm8rh+hej
- TLSH
  T1EA528DF34FA0364928FB6C28D0BD66563D18D6130DE3666CE8087415C575F26ABD38DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  profiles/templates/empty-template.msi
- Size 3KB
- SHA256 16479385744baa678ef195a05ffda741e4b2e835f0d7134eb663cb8e8efd44c4
- MD5 68955079d3cfb05243379d5e75e8fa83
- SHA1 7e32ae0d56d612a72c9a73788bdc8bdee0d81fae
- SHA512 a6f3e94f83fce3c0e17f16cb39667f80d614d41482e693edd4bccbbfd11694cf5e89a6bdd07182886094809d9cddf6e6d32ab469b4c2d81c47d99c44788cccef
- TLSH
  T1DA719082BB65DA29D44547358E67C759A331FC80DD92B31736E2F31D6D310D01E82751
- MD5 SHA1 SHA512 TLSH
Score

6^/10

persistence privilege_escalation
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  profiles/templates/file-update-test.msi
- Size 111KB
- SHA256 9a531029dd0c8abd74eb03d94e2b099dd537b697f5f6335ac9bcb8a1766918a1
- MD5 728453c1c78cd4ba60edc55d8a65bc22
- SHA1 645e622d37798e7e3c0b396cdd368d3de5f63ab1
- SHA512 10e628de036fbc2fa5cabe4e787b50db4b410ef490527014d34ac52242b080243a85d083a9bf94217f4bd3aac087dde51debefba6a1bfdf5ccf32dcd96aab28a
- SSDEEP 1536:c6vQ4mt1PCXNR/rZ+YklvTYh0DI4B5yOjAfnnmMlQ65BAPqd8kms/Og+:0sH+flvTYh0DI4B5yOj4nm4Q13D
- TLSH
  T160B34A07B7148BAAC9D88231539B43636BE6DC78C5A20379248EB2593FF647C35E74E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

persistence privilege_escalation
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  profiles/templates/fooChainedPackage.msi
- Size 192KB
- SHA256 82f7f1c197f48cfeb1017b783583adfcb61bb2f2a36f631b49ec73a2789694bc
- MD5 461f92c02d210fc166b2066aa646ccc2
- SHA1 7533d0ef11aec16ca5e41f13a737fe99435583c3
- SHA512 3f122c487d616aceed6eb607f0042bcbfe02437eae23c75f4225b084c9d1c43da0c09cf7745da3c81c92ac4d26667283a07e9a1d211d0c9c69869540e381c315
- SSDEEP 1536:LtkZbaXlf6gXVLONE1ZTLqVr1CTX3zEYf9WAAiGOpJA20jgcipdsUEPLXjEjCpHb:O0VLONWqVyX3oYf97A5OzA20j6xEvO
- TLSH
  T187141707B78A423BC54F1372614F67A2CF708C28B7A315129689B62D3DB2790A3F76D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  profiles/templates/fooRTF.rtf
- Size 157B
- SHA256 720ced3606d8abda3f98e796255d4e1bf20164eff7c5004e7635a7b505e9990a
- MD5 98f6b4efe3c4c8de0fa9120fb8b998be
- SHA1 e6f754f9433923937e33de0779a8c9bbac571c74
- SHA512 f51f2d60551f95b4414f7b84bc870e3c172f9f2a1ccbac089b3dbf14b49c41ad446da551739ea6abc89b1d16cc8cf4cd99f6c7a1d16b2e82f1215df9f11e36ca
- TLSH
  T118C08032465C50F41045F3D85AD191584B5B4162D467F04250961B65FCB746C1050080
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  profiles/templates/instname-template.msi
- Size 4KB
- SHA256 91594c292835b5f30615513968959479356a832365e33d07d9b9444165441008
- MD5 332ae3988ad32d5957a4d77d9a63c33a
- SHA1 b7aaa0e6da167952c7e93cea6d0ae01a1811fa9a
- SHA512 cbbf8e5d26182ce53d8f585a356614d3018dbf3851b9901c9aec76474984a6440fcc64ab6a0d8413870dbba76452ec50ef59c20184419480c33ebedfc4a130b2
- SSDEEP 24:rgN8Q8ZOChxGCT845X/q+BgkNll0gtT3F6DzqE23r/Uqq8r/HJPSnrJFhYvCL:rgNCXhIwIkVIr2TdHJanrJF
- TLSH
  T10A91EBC2BB608A26C04946315D2687466332FC80CDA397173E66B34EAE321843F923D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

persistence privilege_escalation
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  profiles/templates/ps-script-test.msi
- Size 59KB
- SHA256 4a1635468f36b817ae1229ecfbc766360934b8f21c1f9e1d9dc47eaaf45d835d
- MD5 d93fc94470a651d1993a6baf520c2f06
- SHA1 64057e5f04ae183e707a2e398c3f035d4e577e7e
- SHA512 2ab483ad4f4f27063a1a7f3f1a348452cb02017dd6bb483b81b4e941ef3bf2e47f524514a2002adde317445bdeef9f51bb01a166f2c86e7a8f1de4d3d5d1a6f4
- SSDEEP 768:2mt1PCXyAbj7dQwAe6sfy2Z+jpC5klvTYh0DIKLbzRj95yUp5jL+feWyh7:Dt1PCXNR/rZ+YklvTYh0DI4B5yOjbJ
- TLSH
  T18643F64BB7A8477AC8D18232630E53236BF59C78C6A2033858AAF35C7FB945476E75D0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

persistence privilege_escalation
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  profiles/templates/search-test.msi
- Size 16KB
- SHA256 5968c8218b98fc24b268d3fc9da41258acae136823be6b52c0767a01065722d0
- MD5 56fdfcbbd2d821187921619983e2049b
- SHA1 e370bac6890c7af251f3aa1413fd2a6ec48dc5ab
- SHA512 b59f9b316b9bb456e98a905f7e54b4df60efc087d4fa642a138724fa7a13a0b8fa6a100224c0d9ecdcf273b09b2fd27114e8cbde7cc89e9c9b35d8ac2a570afb
- SSDEEP 192:1xFrdEc211jscWPxq9BuRztqHQFy+NA2NRVna3tWpl3B7Uk3pO9CNb17EnffqWl7:1vSc2Xjs9zqHQI+N9xM27nOQp7E6i7
- TLSH
  T184722AC3BA969236C5462B310A6B938A8771AC114F869E1732EC775F0DF2AC037175F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

persistence privilege_escalation
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  profiles/templates/sql-entity-test.msi
- Size 111KB
- SHA256 b0218e74cc779999125aaba0cd8fcf1daedc4d41fc624fddcb6a24dad6a0e623
- MD5 cabb11ab1aae07957eee9b34fc3413d7
- SHA1 35498ee1c23d09a3140ed3484294b83e627112e8
- SHA512 30d3cf38c748f983c5cedde9cedb34d4ce38ddaa8258f5e2fe722f591708605af4c4bbbc933749c2a8f372fb21f933f32798566065a33654f347554389527d12
- SSDEEP 1536:YFkRQ4mt1PCXNR/rZ+YklvTYh0DI4B5yOjrH+nmMlQ6LBAPqd8kms/Og+:2sH+flvTYh0DI4B5yOjrenm4QD3D
- TLSH
  T1F3B35B07B7158BAAC9D88231538B53636BE6DC74C5A20378244EB2593FF64BC36E74E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

persistence privilege_escalation
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  profiles/templates/template.msi
- Size 4KB
- SHA256 e67e3e72e6adf5e2a459ce9a0a74b7659f2d1da9dc4d40d31bae79b18f4f79bf
- MD5 b93c1967102d3f6f87c2605cc9ed44fe
- SHA1 f8374e0a912797fca2d1f32373ec74ec2ef7f891
- SHA512 638cd9264b982f6a79aef6341be9cf670ba942c435e2130aa894ecd47da6a48e5a3f61a84792f19c73c413342ffec60008ce0caf3bbd72253da93f404cc43b8f
- TLSH
  T122811D8676A0CA33D88AA63B8EE397595372FC008FA2130331D3B34D9D721D01A95AD0
- MD5 SHA1 SHA512 TLSH
Score

6^/10

persistence privilege_escalation
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  profiles/templates/template.msm
- Size 20KB
- SHA256 e9c7fa36c8a2c75ec9da78d3019a6c37329b0be9f8c714b66159dcb8e2c0fe43
- MD5 ff247dd836aa5ed67e974da8f8927691
- SHA1 61b55449325ae2049182569b174c6644b936369b
- SHA512 e9637f8295c156297ba0496674472341dfa6ff9d12e8efc40626ea00c6fb72a947182796bc34c0135e9380e84ec5fbe64044be4e392f19b2aa2f4c753c17f709
- SSDEEP 384:ifLf5hK/COtqN6Yp90VdaYhwiSSJKJrG1ty1XRm/zW2DP/D:ij/K/CBPpScJC+vm/lDH
- TLSH
  T1D692A82B6A441333C28202719B1F97E5DF3A8CAC4BF65621689FF19C21B1D6453FB5E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

persistence privilege_escalation
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  profiles/templates/template.pcp
- Size 4KB
- SHA256 e7c6a6e75b50c85149ac107364770fc7eeea4880425546d44c2e69949dc2853a
- MD5 d8f8c5daccb85d55f1bc3aab39efa7c9
- SHA1 dcbbc442543209f8bfca896f414fbe2c2926e433
- SHA512 1c3575769a1776932085d1897ec02e78ee727931e285386676c50f06510c89a86bc9b7d01c48e3941d9572b28fc80e1facf50412b806043e46987f9bcec112cf
- SSDEEP 48:rgN3kHkqwtryisTTOdufF2Fm1NJ/3m7F+brR3xDtJ1M2rxDtJ1dc:gqIgrTqufkENI6dxD71lrxD71dc
- TLSH
  T1EA91EF43BB628A32E5402739C512C7091375AC909E522713B7F4F39D5C76280BFEB1E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

persistence privilege_escalation
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtSetInformationThreadHideFromDebugger

Enumerates connected drives

Enumerates connected drives

Loads dropped DLL

Enumerates connected drives

Enumerates connected drives

Enumerates connected drives

Enumerates connected drives

Enumerates connected drives

Enumerates connected drives

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32