d0d3b258bbf52fe883dc371ea96771266441c97d3c593071b8c568ac29db2edf

Sharing

Copy URL Twitter E-mail

General

Target
ADVANCED-PACK-SCAVNDAL.zip
Size 27.8MB
Sample260722-c79grahh72
SHA256 d0d3b258bbf52fe883dc371ea96771266441c97d3c593071b8c568ac29db2edf
MD5 aa2e3127e9f093021b5db3264cd7bd0d
SHA1 b8f7e1278637897fc6ffafa8f0d520b1a0e61c00
SHA512 1826b94a021e7dfa23e8f6269ad78f98bed8b315af91f003f2f64507d8ba02bd7314227b11a0b55380971f559ad0ece7d83634c540ba642e9b1ac81e4ed64a41
SSDEEP 786432:hC4cqTtnxdDqkrCyk6bMG0S4Hr0/xiAcb:IzwtxTbMsvxiAcb
TLSH
T13E573335EC1C3C1EE94A317E155F7A25972F25980A80B9461B098F5CBA80DE19B7F0BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  ADVANCED-PACK-SCAVNDAL/Registry/cpu/9___revert.bat
- Size 137B
- SHA256 3d55b1022be9821df09893c3c0a2ca67c28910bda472f09e8dcc7c9f277e0cc0
- MD5 183f8d7bcfa3a9a04ccd1b8dc9db6c49
- SHA1 b342a9115768fd6fa11cae7b115c7032232ff8f3
- SHA512 147b8b2eff1f5e09d399d4c4b3d90f163e56d34e85d7d5d308daebb6534b2ba4ed1b086037e99c557ce74b4efcb40dbaee60fa36de925b32f96711aeb01e81c6
- TLSH
  T199C02B0393182C3FD0098F041097C0A618C7BFC43332FAC9B0C948A500D1141475C943
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution persistence
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
behavioral1
- Target
  ADVANCED-PACK-SCAVNDAL/Registry/game/10___.bat
- Size 159B
- SHA256 62eec2a79460accbb28b95248275ff94cfeca416fc7ad6f2d5336cc90f26045b
- MD5 190c59d1b216bebb682e9dc3efafbe99
- SHA1 e6aaa3fdf1a3e7bb3b21d485f44a4d4ecb13ae16
- SHA512 4cffb9ea8bef9159bf68dabab825c8097ea539f22848eab0e3d1255044d7f7e3e7978d96a832664ab820fc4931f24952113e6fec0f4c5bcca54cfe3db19cf7bb
- TLSH
  T1E4C08C10822D48A1E568E228808767173F7A45E39BD38B2C100AB05583FB1ABC0FDAE1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral2
- Target
  ADVANCED-PACK-SCAVNDAL/Registry/game/10___revert.bat
- Size 149B
- SHA256 aaf2b46e07df76e1e1f97d0c539e5b855086a566be4813b5dcc0349038ea3ace
- MD5 fd05ced1da6bbb9f7618e74bd86e5a43
- SHA1 b27891176014a830f46b42116d313253831f03b9
- SHA512 0f568967d3397cd4e7159678a7338ada162a62f2cce51b43857770151081f68666bbd9b98715d9f89011a5e610369ba67dc812001a7ee74591da22403c88a608
- TLSH
  T1D4C08011431D4C605024E104819706173BD5435354D3A69C10927000D6BB251C0E56D5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3
- Target
  ADVANCED-PACK-SCAVNDAL/Registry/game/11___.bat
- Size 281B
- SHA256 dd019276d0358a8af55f52801b7f50c4004bcdfc05d3c988040a50671f18283a
- MD5 0f2fbc624e807bd5304b19e3a1dd4d4c
- SHA1 9e43eacfdb0558ba01d1482302b019383d741fe2
- SHA512 1b1780f75a36af064451d8f640013950590dfaa2bce717438b856672c8c44955df60fb5dee2aea00d0213f2b289b11f01c2e77b08e23aafdf58b070792da53cd
- TLSH
  T186D0C210C51E4463D5A2B610289784621FBE4E4312938B002889F02681BF18780B8AD5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral4
- Target
  ADVANCED-PACK-SCAVNDAL/Registry/game/11___revert.bat
- Size 264B
- SHA256 6686006af6ab523731a6056f29bc16c3858dd1ad86c7e4c8e624ca9313132e75
- MD5 ff12d8255da726665aecb399530d3b45
- SHA1 c1e0c74e4f1f764c142e5f02590f4fe2c4a2e70e
- SHA512 20c3e36763939d5965c9059b3d274a9f7d5cc4abc5e1d263937a61e4c5544e525eb27ab468a24a8b3889517ee3932b616cf5532beda9bb6175ffbf5c856d5752
- TLSH
  T112D02B13871F4C229072B54114EB88671BFE4F032063B68024D0F020D46E74181F4FC9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5
- Target
  ADVANCED-PACK-SCAVNDAL/Registry/game/12___.bat
- Size 78B
- SHA256 7181758a9318a44a1059dec4bb34362d50eb7a7eee3e1389113b7d2ecbf92d6d
- MD5 41959289069223cae0cad92121f3c4e0
- SHA1 807ce256043f099a843b5cb833d7d0c2b0c28999
- SHA512 6007cd17c763b0bd8518cc26ea23f0b7617e4adb64ac6e32f622e62f7e35393aecccc5f9f486485650d76692264fbc5a798e6843e425a98535b38942de3f71b2
- TLSH
  T1C7A01204910A0C00940B55A1310210832F1941C34308CB944015400482911B8E854612
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral6
- Target
  ADVANCED-PACK-SCAVNDAL/Registry/game/12___revert.bat
- Size 95B
- SHA256 555c7b2bf5a7f999cc999cb2b487c562228672aeca58532ada46ed4752c6ad34
- MD5 026f3d851ba413859b3579f65361feb1
- SHA1 ae1fd8de6b426c6c5197cc060039b2b36d732626
- SHA512 ab0fc3a4958cc62b914414b50981b17bb877bbeb40c9e9762d124e8e35e3e61546b9aaa5d59417ebcdb588682d69303cb773da965a70ef314e932608713488eb
- TLSH
  T158B0120BD60E4C0AEC9BE9A120A200C766C903C30A08EFE59073040489CC3A4EC98A03
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution
- Executes dropped EXE
- Loads dropped DLL
behavioral7
- Target
  ADVANCED-PACK-SCAVNDAL/Registry/game/13___.bat
- Size 2KB
- SHA256 199e5f24ba81f482634708941e0b562d4ad0881e267fe426bab17d48302c2b9b
- MD5 cb516ed95cddf7d1a2c3704229ff1c1e
- SHA1 98edbb5c1d42ad880fb786771cdce1b856c02257
- SHA512 2f600eff965aadbe8ff064310e45c124cfa4ceb8b78ebeebe6d3dc3e9fe847659c4d5f37e9c8cfbaaf3cfe6cc1797b95ca1d14c76a6c670ca64dc13b7b8e586e
- TLSH
  T155510340F13A427BD6B7B62098C70293AF7B6DC324605FD128A33126A863DC7D9393D2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral8
- Target
  ADVANCED-PACK-SCAVNDAL/Registry/game/13___revert.bat
- Size 2KB
- SHA256 91fe446cfab2eed778a05df33edf1d1b73a2534f4fd3ba67e8edaf6edb09acf2
- MD5 eb5d5275503a8cf3116b3c1444b2e261
- SHA1 d7c7008b39cb9708ba2afdcfcfa932718be95995
- SHA512 66b4793539d0b5d12a2ea7b2792f1342bc1dc09cd04f5aba97797dc4a684c41f82aae44ee5050732386bb5db6d28bf8effea7c3f53a6986fbc034ef666e36de1
- TLSH
  T16D413453733B5E1BD072B680D4DA49932BEB8E8734637AD116E23110F813F8292353DA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral9
- Target
  ADVANCED-PACK-SCAVNDAL/Registry/game/14___.bat
- Size 216B
- SHA256 4c3924e7f80b775b2ed759e6163a3c1eeaa263320d1ec40bf4b96b6806202f3a
- MD5 e9a9a34c717417931b12470c462b3dec
- SHA1 c5db949bbac507728de7ec9164c7381b2648901b
- SHA512 48a12636f24a69704d450d0fb18851f1acf8f78a313563b0e2227ebac0df6eb68e3251d54088f85e2c6c379fee548f176309bbb12f50cdb66a8d44b7aa5607fd
- TLSH
  T1C7D012C619E121D12FC4C7F79750E0C79901C26C830EDAAE4025F25C47C51CCE044BA0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10
- Target
  ADVANCED-PACK-SCAVNDAL/Registry/game/14___revert.bat
- Size 263B
- SHA256 1d9c464361f87a7d59f9a9e687655ca4c2cd5c1158e8d154b6caaef01629e0e7
- MD5 3f4b7be3c2bad60a958b4cc70eb54e86
- SHA1 9f08e76cf3fe877bc211584770142237d1fcfd59
- SHA512 7faafda5d073c57eefe36861dbe15ed0253e481bca20017d5678c269eee5cee23a6da6b77e8d3021bc533e1015a928b256c759a3850d9a3baa85b74c87abd3fe
- TLSH
  T1E7D09B8B2DD51C9D3B8055F653F1D49651C2436D0D4DFED8A1E1711967C43C8E244E94
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11
- Target
  ADVANCED-PACK-SCAVNDAL/Registry/game/15___.bat
- Size 2KB
- SHA256 8806cbbebdfeb60b62bf4cb1e6edb25c69c27bbc5a39f93c810e42dc8fd85b41
- MD5 80c9b2f627be5f6ecd88217f372b0062
- SHA1 876dc58d47af086267a8661538a2499658ce435c
- SHA512 1fb6266f0769a0585ed9fc39173dc30a5f0a0489dfa7d8cb0c4026d1916cef4415e9b6b3202cf3215a4d94af6b3ec94fa9b96e23fad9febab8575b5424f6ee56
- TLSH
  T1AC514B42C4670B72D04ED129B712CD554FB6BCC64AC5CB51B83BAA0310E316ED8BACEE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral12
- Target
  ADVANCED-PACK-SCAVNDAL/Registry/game/15___revert.bat
- Size 2KB
- SHA256 9df89cd5328195b0bc34a81f1bcc3b2ad330e3380bfb5b237bd7f3f6e5918d8c
- MD5 cc85863810568602a5607b126ca44370
- SHA1 98fc4ba072f225449e81d6c8ebe596d03b922336
- SHA512 42a67a418db497e8392c4a9f7c577c094ea7ddf37689f0ccfe12f7edd3e324bf7784419ce5b18bcf570e41fe3a08c4b1dd571943b6ee9d764fba2082988ddff6
- TLSH
  T1B651384346670F30D009D05AF329CC560BDAFE8A19C7D591A4B6BB0274D1668D9B3C6E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13
- Target
  ADVANCED-PACK-SCAVNDAL/Registry/game/16___.bat
- Size 1KB
- SHA256 f949901e0ca88040da7f06ca91488ef5f6ca18b06447c607719100007d3303a3
- MD5 8fb3fdf9a719171e26abb1ab290d0bd7
- SHA1 cb2f4513c26a7d9ffe32e78364be05f8d371675e
- SHA512 deba731c2045808c9ff63fa204669b1443f4ad4e717894815e30d8b8aa9a57edff8f3a3ed25532570f6679dd88c49e2c4583b27a06694a6c4bcce8b9f7672681
- TLSH
  T1A731E720B96B40BBDF51F231E1875A16EF27AFC308405FA13455321B10BF98EC8799E6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral14
- Target
  ADVANCED-PACK-SCAVNDAL/Registry/game/16___revert.bat
- Size 1KB
- SHA256 2b4539cde5c396828ff76f108a3e89dcd13dad9b250048900f7de5e075589a51
- MD5 8895d157155c53f8b956ddb9430cb5f5
- SHA1 de17eaea4023b4e9a572070d8ba3cb8959d9be89
- SHA512 31fe5fcca0102ab77be42d3ba1f9abd1cdd4cdee5893260c4029025ef602aa101270a260988eab14c9b4e490e2fc600ee5f25b1358559e10bf2eb4f25a7e9311
- TLSH
  T1F23129273F5B5C5ED910B1C2E09B5D175E8ACF871C427FE112E0310AB42AB498571AEE
- MD5 SHA1 SHA512 TLSH
Score

4^/10

execution persistence
behavioral15
- Target
  ADVANCED-PACK-SCAVNDAL/Registry/game/17___.bat
- Size 1KB
- SHA256 b32d11b7ac91af5e5a6a6e506dec6f8405afc1ddacc1ff0fdf5075e57c4f6c8c
- MD5 df1797eb5ab38e9a8ae53841db4470b0
- SHA1 ff5d13c4afd9d048a1e1267c96654ddd5459660f
- SHA512 da2d9acdde8c059bf6b684d6356bfc086a4f06acae57256a8dfe88b6deb1af4316cbc00e2f3d5e9c1ced66c2d11dc3e5a8edc2cceacbd42c4853740c1ada12ff
- TLSH
  T1A0313921AA3B8373CA86F118F3438E329D333D8369808B516CAE351F10E745ADD7A2D1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral16
- Target
  ADVANCED-PACK-SCAVNDAL/Registry/game/17___revert.bat
- Size 1KB
- SHA256 ca4e84a79dd0cb3318c53079f1f04a88641193fb85e8867a919d1aab9d3c6075
- MD5 40bc8a8c979140aec00bb98c338752e9
- SHA1 70d6154b4bdada14c9e3bfcbd0ca963e2f7cf4d2
- SHA512 67ce8df5ab76db78569526eb749f8a24c52df13b5d250459b223c920d1db80fc816533fc4e352e8fd194694a43fc8ae528e5268e9c35065cc50d87d1aeff5d69
- TLSH
  T11731F5232F3B4F35C441A0C9F3928D3319A76F473C92A5D155E53905B4C2A159AB27DD
- MD5 SHA1 SHA512 TLSH
Score

4^/10

execution
behavioral17
- Target
  ADVANCED-PACK-SCAVNDAL/Registry/game/18___.bat
- Size 371B
- SHA256 77031844747dba69e9ec91e80dfc54418318fbd916b4e8d723e452103ed9fdc5
- MD5 b1a504e541a642faa7b699db21b00a4e
- SHA1 c16fb09d737a28d5a2a66081c4e522c8cd85bb96
- SHA512 5f70123bd8f11a6128cbf9dbcff8a3bf02c24201c60c7f59cccaba6456653cdfce924e9d54fef0abc6c1c749d41e39bc97c3d9518c159f0e0f14bbc4862933e7
- TLSH
  T1F1E01220D62A8C16D949B52418464500EFBFDD8315875F42B809731B617B0C7D8789D2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18
- Target
  ADVANCED-PACK-SCAVNDAL/Registry/game/18___revert.bat
- Size 339B
- SHA256 3106459696a2bb6922b0da063f6abdb00793b965d961d16a6e75dab6ac4f239a
- MD5 dd484fe64455652b168d9a294172b059
- SHA1 331a0b6681986ce5965244b81e120ea1213fd8f6
- SHA512 20b74bccd5953b4d883438ca557dfc86bc65d7cf2884bacfa5ca5de8dcc3b91eaa6daf8812953ad07dd1a9a2140d82e4b673d228ec716739a3fcd742e898d5be
- TLSH
  T159E01A23EB2B8C199858A485985948066BCECF4328977FC265D43306B53B6C19474ACA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19
- Target
  ADVANCED-PACK-SCAVNDAL/Registry/game/19___.bat
- Size 616B
- SHA256 9de86019551d903c1bda1dbd759f1dd84adb00d2aad4b6aa220fadd8cd0dfcef
- MD5 5b7b6b5d9e280c304efc07f984f5dcc6
- SHA1 cd2f5dfc999a9bc0ec50c1e6aef8e7d1e9fe1fdb
- SHA512 b2df5fe065bf8b8f23d3648abc69cdf7caf010a7b65a40571124d3e707bc5061c0930b5f5d836f74c0c2e2823ed64bb665cb0c19afb8f4a919125b72a2b2295d
- TLSH
  T127F0492FB5063AF0265BAF61E51182CD5D2C83E10684854AC02DD24C92C40774BF05B1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral20
- Target
  ADVANCED-PACK-SCAVNDAL/Registry/game/19___revert.bat
- Size 606B
- SHA256 c497f1f477ab0248a98ccbad12f7d79b1a2c0373c06cba71035a4fbc7631518b
- MD5 5770234c70b931289be537b26d94b0f5
- SHA1 a11371139798d973f4043b2a10e314e5525a7280
- SHA512 ba7828b4525f30129e3e01e9b7f7a20676fc6f06ed8c0570136cbb3905a75a567165f94f95e5ef44d808c7b0c51d771de239d332981675f7d7d4b3693d2d5b9c
- TLSH
  T107F02D2BE50E36F179A7BE61C68586CE5C7C43D1019A845ED02AE21CA6C80334FB04D2
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution
- Executes dropped EXE
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral21
- Target
  ADVANCED-PACK-SCAVNDAL/Registry/game/1___.bat
- Size 5KB
- SHA256 7571c6c813d00a5ca4b90d0ce491d987df4c04efd15b0ff478909aca736a4e23
- MD5 1c70a38a1e27bce069c193cdb08f0f06
- SHA1 b049db468e2e41f6a427fcfd3126b3c20fead5d1
- SHA512 1146f761a901e2a7a0cb7a16042f1215daa6e904a9afdf13e2ea0d073a2c5c61d599dd6b2179d4216b897ab68fcfaf28957c698af6bdba15120c27ac058417c7
- SSDEEP 96:+PUtwGtrwtE37tE3k9tE3D9tlGtwwtftI9totxtu9tvtY9tmtmtwqtrstE3ftE3x:+6uL6KnB
- TLSH
  T1D8B15D44C62E4233D6D3F20957C38A226FBBEF073441AB1A2465E61B226734AC5BF7D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22
- Target
  ADVANCED-PACK-SCAVNDAL/Registry/game/1___revert.bat
- Size 4KB
- SHA256 785c0aa4937b50de190a0ff89223d458f594f6a8ac19b76c55b0a116759bc2a0
- MD5 a1bf40fb6ee7f3d5fc717fb50b8dde99
- SHA1 2bf7b56fb2508f6d326443974eed2fc747ff5e76
- SHA512 bdd1675a3e836fc6ef202773ae0e97fa438f4d9b34ac0a6321eb12b9b44e4a327a7d14c91f20558aed6e898c131271c6205e3df7428361a28accb41168d3f9cb
- SSDEEP 96:DPZCpRtqRtrZCRtE3xRtE3kZCRtE3DZCRt9RtwZCRtFRtIZCRtKRtHRtuZCRtVR8:DBCpmJCIhIOCI9CR+CxeCGToCxeCV5qD
- TLSH
  T1F1A12B46872F462290D3B18A97868D272BFFDB0B3453B79A50E0F609B211719C2B77DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23
- Target
  ADVANCED-PACK-SCAVNDAL/Registry/game/20___.bat
- Size 6B
- SHA256 fc1a7298f4d0b919c65a495dd7ffed92eb65bb74f819188095494dfce02bf3f7
- MD5 a15152c67c9fe1ffdd2690f0116bbe9f
- SHA1 f0bb9bdce95b4362dea7dd93be083a064614889c
- SHA512 aad8c6a78a94fd33874335f2b9981837971c612e4b77d1a06a69b117de9c969a11ece0bed068a6dd64ae2096026a874f18c0aa38f9b35def73921f3a05ac3f6e
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral24
- Target
  ADVANCED-PACK-SCAVNDAL/Registry/game/20___revert.bat
- Size 22B
- SHA256 8d44f071a98f78308f761d1c01d0187a653cc4280c3e699ee02cbab88e0bfdf6
- MD5 b8a5bc43d132b8659f7186729457b5bf
- SHA1 396d0f3af8336b278572f36076187edf1c320cba
- SHA512 5b6b28ed9eb4ab220e9ddb40d3a52fe9cf4c00cc69c6216c46ddaa1483fd98fd93ed000fbff1173796c5aac891720e4379feb61db80c7a83c5a66910a7805adc
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral25
- Target
  ADVANCED-PACK-SCAVNDAL/Registry/game/21___.bat
- Size 317B
- SHA256 e03cfffe7f73844fee881e402e0bbae33786828517d3ae4126a31bfb4454a686
- MD5 b88a483319291b2c4f393c2304bfe972
- SHA1 b84b555c264bb6c4f7ccea9a5f910a10ad54e8c7
- SHA512 bc26479926b5c23bca8bc1d02a1bd1761e3394809dbd56746c0abd43678ee743ca7adaf933996a61b603d93bc43a2311868a32a5e15694dbcf40da0098c6358f
- TLSH
  T15BE07D1069B60163C5C5561BB58382647FFB6CC375840B90745AA14EDCABC6A86661D0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral26
- Target
  ADVANCED-PACK-SCAVNDAL/Registry/game/21___revert.bat
- Size 300B
- SHA256 50dcfded3649e4ef9b0af839551627013a96e03c6283b4250225da76e223d681
- MD5 14f866f972a4d61a4bfd7a5a6b3048a5
- SHA1 5aa74616bfc2711862d88ba0bd83cde157f80d52
- SHA512 3d6937d5f648bea0f62fc599f270079a09d5510daa5bb44b5439a0936632880a80b339433ab9f55d2952fafb2cc9607d3b1ceeba75f2cf4e3f02d8b3553019f4
- TLSH
  T1F3E0E7116FB70D1580D01507F596816637DF5DC774D336D070D23105FC9BD2443922C8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral27
- Target
  ADVANCED-PACK-SCAVNDAL/Registry/game/22___.bat
- Size 287B
- SHA256 02f36bab8cfcfade460c6c9c2b0f1d9d4f09132b1f32b80ebbbbedf0ac0fbc02
- MD5 95a9ffac850515061c6c45aa2e3c4627
- SHA1 2bfec4dab0c33563ac7e4b5765a18f81663bd7f6
- SHA512 384ff722325ba67b798586498c80295eb3deec838608fba3b363b8c9fd1d466dfae7f935115ea07236ddb9526451ff34a47fbf29b0eec0d9d1dd29cd1084ea94
- TLSH
  T113D02B1556260073DBA4B214D4DB9A02AFB79A8335818F407476312101BB1C6C4B85E6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral28
- Target
  ADVANCED-PACK-SCAVNDAL/Registry/game/22___revert.bat
- Size 270B
- SHA256 7afa27fb8c3bdf67ccf0ff765a5431959d32501e7c7406c55c4603f89742500d
- MD5 9c270f16903fc6646a782ac91781027b
- SHA1 d80ec60fd84bbd6bbf0c9ec7afa3fc6dc22ebf48
- SHA512 e1fae7115093790a185516031ab46c5b435b9ec4d145260ca74acabd69077459cec9d311bac72ca33684826887c1e57b3eec4cb0d3dcf86cb029f2db7061a128
- TLSH
  T1EDD02B1707270C23D5607140C49F8D172BFB87473493BAC170F131109567780C5B46DE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29
- Target
  ADVANCED-PACK-SCAVNDAL/Registry/game/2___.bat
- Size 388B
- SHA256 c64232a39186da0c88caf01abec9b41c9f5c96428ff85a98eb5f77ae922b8479
- MD5 64c360947965d45c18f5782a099bc95b
- SHA1 9871f5b2555555d2a7aa00ef07da455097600840
- SHA512 26438a88cdb67646e4c64a6d35b8f1f2bac56b7b4f58e914cdf117afff40bc4ffca0b20f1592771e35395f9312c65b31f1e3b844c049541455b7f21a659ee30d
- TLSH
  T151E02B603D8A0A75C2E5376C165357405D6659472DC831732866610A56C3578C839FED
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral30
- Target
  ADVANCED-PACK-SCAVNDAL/Registry/game/2___revert.bat
- Size 256B
- SHA256 7fa9c94b72197faeee781a899f0e2f5e8fd3354878c5ed8d2e1c5514cea4d79d
- MD5 cf9cd2ddfeffbb60b5fc3002929dec98
- SHA1 67f6535079cabb52740a5f68e0b250568c1d8f53
- SHA512 07e2ab002addac4f1b7ac1fc50de181f5d16d74956dfdf0be8ab37315b6260c4f3f60c2d86285e84e42ff0980151f98a8b699b4527429c53126b36a8aa27a1c3
- TLSH
  T1B8D02BA13C472C2411F0B3C84A400B0224928A4F19CEB4E35482110DB0C367C455DFFE
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution lateral_movement
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Remote Services: SMB/Windows Admin Shares
  Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
  lateral_movement
behavioral31
- Target
  ADVANCED-PACK-SCAVNDAL/Registry/game/3___.bat
- Size 25B
- SHA256 902ee4309d648085d1405ece4216402228cabd713d1a2f966c774c2447583245
- MD5 600f7d38f7198c51bae4ff9729b51210
- SHA1 ad99c3536b6dea41c66bd699f6b4aa3dcad343ca
- SHA512 e76239861cdbc13655edeb2b481ce6dffcdca441194afb9a1ce74b8bad6f235d8b124fbfcce3ee27584de403572bc6348889947a22e394fcd74b8ff23efb6f32
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Remote Services

T1021

SMB/Windows Admin Shares

T1021.002

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Power Settings

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Command and Scripting Interpreter: PowerShell

Maps connected drives based on registry

Remote Services: SMB/Windows Admin Shares

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32