747697c2ddb72c88d9fbac022093eaa4759e8ab1b98038ff1fbac8124dee15fb

Sharing

Copy URL Twitter E-mail

General

Target
reg_woof.zip
Size 8KB
Sample260722-3cam2swgpg
SHA256 747697c2ddb72c88d9fbac022093eaa4759e8ab1b98038ff1fbac8124dee15fb
MD5 dc410ad1fce4ca6ab602e310aebb5c89
SHA1 87c205c969123f8e69ce152b4937f34fb7f87d2d
SHA512 1f2f4163969e4c1adf7bcaefbaf49a09b6afbd6e7773004579e4d3dac3f5fe6c211ef43dd4ea0c47870819bd599318226ec93fa1842a0e9149f059c02f01cc15
SSDEEP 192:BLrwxNW8X+/mWNnENc0ZheojX+DhM8Z+4b6s5P5my+Gk+zlbGX:ZrwxQa++6EVZI3m8BPUy+XX
TLSH
T11002AFB84281D2F6D9D2B17C40892727CDCEC01AD0D9EE5E5FD5296B0C57EC992C9631
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  reg_woof.zip
- Size 8KB
- SHA256 747697c2ddb72c88d9fbac022093eaa4759e8ab1b98038ff1fbac8124dee15fb
- MD5 dc410ad1fce4ca6ab602e310aebb5c89
- SHA1 87c205c969123f8e69ce152b4937f34fb7f87d2d
- SHA512 1f2f4163969e4c1adf7bcaefbaf49a09b6afbd6e7773004579e4d3dac3f5fe6c211ef43dd4ea0c47870819bd599318226ec93fa1842a0e9149f059c02f01cc15
- SSDEEP 192:BLrwxNW8X+/mWNnENc0ZheojX+DhM8Z+4b6s5P5my+Gk+zlbGX:ZrwxQa++6EVZI3m8BPUy+XX
- TLSH
  T11002AFB84281D2F6D9D2B17C40892727CDCEC01AD0D9EE5E5FD5296B0C57EC992C9631
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  reg_woof/reg_spoof.bat
- Size 11KB
- SHA256 f2cc7019891119e6c1f16d847af30d98c50515c0ff92ceeed9f40637ec11285e
- MD5 5f5cecd4cb592af0a5f53f8e9a024767
- SHA1 8b30262b1e85e8537dae8089c91eff6fc617967c
- SHA512 13e57302d31315829f31b1c600fa2faf62103491595a6640c469f5bfdde4dcbaefcfec56c4c7cb0321b6cc78f18605286ab391019efdbf0b7d1fbd7b57062e16
- SSDEEP 192:m2Skk6iqk8XjucsB6uARkjxZT9VE67V6TzVOU9YDFOZyn45phW4duyVCundTYV0z:m2SCiqk8XjucsBPARUxP66MfIEusZy4r
- TLSH
  T1383274223ED08C6BC1C545205853EC4537E931DF2782AFCE739995C86C7A7D463BAACA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution ransomware
- Clears Windows event logs
  defense_evasion ransomware
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
behavioral3 behavioral4
- Target
  reg_woof/reg_spoof.py
- Size 22KB
- SHA256 389ab0bc74b8509ff5586a83a20863b2b106e036dc819036509224613ba0e802
- MD5 11d6f883857aed1ebc4590269caa0124
- SHA1 c5bacec2b24f8a15b580f162c5575e6ad271d3c7
- SHA512 d0d54ee8d33443767635e9d5d88358403b8d20b2a1b7b9f30966b6497d634c5cc5be2c3554b9ae53a2d3135f9edeb646a70570e1d89ac01ad329d02593cc2399
- SSDEEP 384:l2/xzq666662X+FXZITXfFwJY5gite3wTWc06L5LGFzmXUnJiMWgguZb0MttpgYp:l2K4wTW4UnJiWP
- TLSH
  T1A7A20131AD664056C4B3CD286E71AD10A22913A2E7D09E0773BCC1D4DF35C9ADEED1AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  reg_woof/setup.ps1
- Size 2KB
- SHA256 aa1b639db4276f293c6819fb6359974941c43e23e1ddc9f1e1dab8b8225e9744
- MD5 8f1d11fc69faa661322a8489971e0bb9
- SHA1 ca4064adf01a48b951bc43904f130c92fb4e83d4
- SHA512 ce77fc0cb976a9bfbb104512a2745ffe38e18c11d3c178c82c802acf8a5b70e90cf47e79134bed975805942c93f8403e80eedc0ee5f0c3daf67b33d24144ac21
- TLSH
  T1B351E05A9157712E6AB60E6E004433A8DD66D13256A30DC0B7BC81BDBAD2B2D43274BE
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Clears Windows event logs

Checks BIOS information in registry

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10