011168058cc23a3bb54ac6ffc104ae0d7b35d33473c7556da980a750bf5ba1b4

Sharing

Copy URL Twitter E-mail

General

Target
shhhhhhhhhhhhhhhhhhh.rar
Size 894.2MB
Sample260722-e7xjasaf37
SHA256 011168058cc23a3bb54ac6ffc104ae0d7b35d33473c7556da980a750bf5ba1b4
MD5 0ac0db79879450f75996f457f05131f3
SHA1 67cd5976d34e9dea104ef13929632117443bbfa9
SHA512 471168a0980e7fd485e420282549eb00373f06ddcb484558b63c3cc17ba78232407ae5906661c7fae822edd85bde0e0ca256f031e23e2b2fc2584ced9b27c3ab
SSDEEP 25165824:uIWJu7LHfeIlSYB17fvmd/Q/Uag1yrwSJ:Lw3IlVfTUB1y1
TLSH
T1B1A93310A052FB336159CE4340FFF36C9BE788459CEC35EB8246C76E9D92A74466A7E0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  shhhhhhhhhhhhhhhhhhh.rar
- Size 894.2MB
- SHA256 011168058cc23a3bb54ac6ffc104ae0d7b35d33473c7556da980a750bf5ba1b4
- MD5 0ac0db79879450f75996f457f05131f3
- SHA1 67cd5976d34e9dea104ef13929632117443bbfa9
- SHA512 471168a0980e7fd485e420282549eb00373f06ddcb484558b63c3cc17ba78232407ae5906661c7fae822edd85bde0e0ca256f031e23e2b2fc2584ced9b27c3ab
- SSDEEP 25165824:uIWJu7LHfeIlSYB17fvmd/Q/Uag1yrwSJ:Lw3IlVfTUB1y1
- TLSH
  T1B1A93310A052FB336159CE4340FFF36C9BE788459CEC35EB8246C76E9D92A74466A7E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery installer adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  shhh/Toon Boom Harmony Premium & Storyboard Pro v 24/How to/How to.txt
- Size 72B
- SHA256 aa974ae73e225b649a489f1a88707734f1f650af01536cab19913894f125183b
- MD5 659794643757b344877ccebc2ec8e4c7
- SHA1 be12e0b64c8d5d173c368d9afb345e12bafb2832
- SHA512 f54540bbf9fe3a4b43b7f83e4d87b5f3d5c75adb88a32244a7a8cbfca50bcd8153740b07d0fe0f7fe3203400f8db32624a7ad408ebda159a4f759292cc2b5bfc
- TLSH
  T144A002974DC657F0D8E0FED25A5F1D039105E882325D04C0ABD13B8FAA36BF25D145AE
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  shhh/Toon Boom Harmony Premium & Storyboard Pro v 24/How to/install pics/Screenshot_1.png
- Size 73KB
- SHA256 25c17160cbd3deb27674b9b29be486fb7b0fb37b59856dca9f44cf97e38b1616
- MD5 e3f94ff6e23014d14b12024a6de7191e
- SHA1 23eafac8756ce593655969d66f5cde22ec2d9309
- SHA512 1e2eb2722c4083820e3534bbdc92202da0a08d8da974a43b7b94a6c4e2b900c74c012bdafe0aa138f4884786d776be4e8916c281fcebb4c984d2a4aaea5480f5
- SSDEEP 1536:HYQzNz/zxb+ZtiBRW3IMIYdjdMzj2owD7/LJtEw8EnMSf:rFtZMIUQj2tnDEZCv
- TLSH
  T10B7302B1057308D7D91FFC317AE52B79B8923539CB9862FCD77679902100AA2A5DF052
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  shhh/Toon Boom Harmony Premium & Storyboard Pro v 24/How to/install pics/Screenshot_10.png
- Size 16KB
- SHA256 df42e06897471069a87c6445f183f1f2160d7844b572f5ea8b593ca9aeec867b
- MD5 4b8c60a55833f22d3e2a0dd899e60051
- SHA1 25341b5e74655409cbda2b6ce23cf9b07e9df388
- SHA512 1c1ff1c7cb7c8e84a2fbc14116c4678ffe09e35238e0e92cfc7749f6bb47d5b574c136039a4dfcccc9aad06fd5868f60722d3deefc5f62a1b0c8beddd68a8b9a
- SSDEEP 384:A0AmIYwHsMYJXgpTdNcBvcoycbSi7Hno1NthKbPaE0vYVLH:xDwMAtZERbnoxV9vm
- TLSH
  T134726C357B3CD64AD9A63FF649E3976881000A7382605BD3BFC87C84AD1D5B0EC93985
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  shhh/Toon Boom Harmony Premium & Storyboard Pro v 24/How to/install pics/Screenshot_11.png
- Size 28KB
- SHA256 25b92f8fd5c875d47f6b6e4f156eeddcf2979053ec4a71498cc5cc482f763c10
- MD5 131790c005c79db385d243ec2686a141
- SHA1 8defd5ad9659436aba5f75ab61c5a222e8366445
- SHA512 7aa89fb0618845e8ea55da4ae22d61dd51ae8ababb858c82c5530cb592ae4de23ce5ba106875fab15510de6c256e337095a849bfeaf9a4cdc81601fd4358c581
- SSDEEP 768:kbCA5n2KGXRS9pE8UqeWEdQ8XbjTBWpYueVSzM+t:e5nDEDqubjTBWpLLME
- TLSH
  T11CD2D0FDBAD79C9B5D2571BDA618F97C0403740578C62CB527236AFA0D6F85988FC810
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  shhh/Toon Boom Harmony Premium & Storyboard Pro v 24/How to/install pics/Screenshot_12.png
- Size 98KB
- SHA256 50007c9286835a6b6f28f7f0b7c156fe4e3c4a7969bce121daf627a6e6ced920
- MD5 84d413da56feae67e115743e4054441c
- SHA1 b5c512ac277046558dca0a9bbce088d1a75bb2bb
- SHA512 a71bad834ac548c9ccad1ec19d7e7f8cd718c91afa8125a61540cc1410db25e6bd760c5a3603a9004f82b9611f856dc220c1c3625cfe701ccaf8c744fa7430cf
- SSDEEP 3072:8TBqw0skuTDV9ehCqYd76EnofAcYJa8/g7r:7bkTDKY96EnUlYJa8/Kr
- TLSH
  T158A312E25B9D81B17AC7960A057EB61E0708D8F9EE4E407A4C120D8FF3CA79516EED0D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  shhh/Toon Boom Harmony Premium & Storyboard Pro v 24/How to/install pics/Screenshot_2.png
- Size 34KB
- SHA256 08c324a62c7b727cd2e51ee3a5f1bf0e3adc83aca0fd4440220dd8bc187f39ab
- MD5 d01d778dfe82865bbc481b4a05f987ed
- SHA1 cc52ea3a7c31dcbd74bc7553842c67ac3d173cf0
- SHA512 ed9f40e3df5bb8d35fac7b1dd910cd4734d6590c36482e21da10c1504f99890dcc84c48a2b6e027e84173c9780957618a4929e88bea45d0281b5d8d9a15fc9bb
- SSDEEP 768:YiX+ZdwtYHVtWrvJ1uVW/mMJ2tYV4kA4t3EPbasjgyVNNKqsOqXhu:YtZyyH2/R7V4kA4ePb5jgyJKqsOqRu
- TLSH
  T1B6F2E11DB9F3402CC2B54B7D212D16AB577229B3308217A0B3D277877A8B5F5B858E53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  shhh/Toon Boom Harmony Premium & Storyboard Pro v 24/How to/install pics/Screenshot_3.png
- Size 24KB
- SHA256 87adaadefa5dd1cf8d2e9a6fd48457e13253abf04b5c12efcda925bab502faa5
- MD5 92019252430cb476362617646f010b28
- SHA1 cdf53279fe91d39c9d2a10e0af7218f85fd3fdb3
- SHA512 c346487455d8442fc5d1e40fa3d5ff1a956c62ddf38c3fe89f4a8d04b3a2e157e3c18c7273c63dffa963ede76c54cd306849f2e9b853834b2b31bba2c27d5f51
- SSDEEP 768:ERHiUixf6yFdWWm98pyr5JXM8OI5fWfbebe:0CvxfxTVm98sr5JXMI1gbey
- TLSH
  T13BB28CC3B46140AFEC1D41764190DEBF43B51E6C74F28F9B5E238AD0AA139B6742B95C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  shhh/Toon Boom Harmony Premium & Storyboard Pro v 24/How to/install pics/Screenshot_4.png
- Size 23KB
- SHA256 7cb65bd7eaa285556aca6df7efa7118657fc1a7fee85418811b8f461db9b6ac8
- MD5 e61ebc493ac0324d1601421d468bb32a
- SHA1 a6d4e8b7142345db1218916b6b5f7935a4f73fef
- SHA512 7f27f684b7ac3b41f3fcf956efcdc96f7eef1e9f38f47b2eb0e0564fc178a920b5c5bacb3d66f140ab93adfa2a8e38c123e80bf30eb135e4aefc2baa639c3820
- SSDEEP 384:ypFQyEE8sD2OGe1Xse9+ysK9T5hpsKnHih2KNPPknHBzQmfUuY7jWg6:ykBqyledse9Xv9T/ps8ihVPcnHBzQmfn
- TLSH
  T129B25A606872A29CA7C8305C5B675DC70AB10B7776BAED2F84BE474CC84A17305BAC4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  shhh/Toon Boom Harmony Premium & Storyboard Pro v 24/How to/install pics/Screenshot_5.png
- Size 25KB
- SHA256 950e52a7fb0a427671b148d0f0bf706e2100561b20e2e67a9c169b70d03e07b1
- MD5 0ad1b07f023ef70c8be11ca61bc8ef8f
- SHA1 6dd5a65d945e8bbb0228b8e7e77fc7c789188e4f
- SHA512 aeafaf17cf8d5427116e966a91dfe51191cf6ff468be9bc66cfcb97990ec0a32db4870bea7eeec27cf0d084359f0a264e297cfda9632dfcd031c798caaac1f55
- SSDEEP 768:HOblJAf/DPUJOX8ChVngbdLaiiGdPs6fvxdo7FOPbu:HylJAzPFRVgbdLZp33vi
- TLSH
  T123C2CF462957C1CFCC9C80B0898E669A6EB28B5174B2134F2D477AA776F30716137A3F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  shhh/Toon Boom Harmony Premium & Storyboard Pro v 24/How to/install pics/Screenshot_6.png
- Size 28KB
- SHA256 9aed59d544a0abbd9f2d8f492d9a76b2a2fea47bb3d75f91f35ddd2fa29432ef
- MD5 390d02b163082687f34ac95853dfdde6
- SHA1 91466ec06ac9cd46fedf0a5ace844088386e8b19
- SHA512 2a3d18ed4159ebec306c72073f5140a79b9fdac984090d973051628a9436c4661d3d5e43197816dd15b79a614a555f1b4754eaf97ff39564699ac0b0cebe7a79
- SSDEEP 768:hrLbpy2Q3FSSEV7mbyT9uKFtDxHmoptirrt+7AxDLL:BfY2yFOT9ukDxHmwap0Adf
- TLSH
  T111D2D0D395E13BF8CAA4BC364850AF52B37A52696483DCC5E6A030D57154D27F4ACFC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  shhh/Toon Boom Harmony Premium & Storyboard Pro v 24/How to/install pics/Screenshot_7.png
- Size 98KB
- SHA256 c74a3d7daf39641a191fd5c599924a53e1e8e95e5f9ca27c3f23a461c7997329
- MD5 49d4803becfa8e242b1a09db7f852217
- SHA1 d3e91da1c77c886c5dca07da7d3b199fc8df3bac
- SHA512 488daed693da8f00048570378a7ab8f344a6c80b83cd6d17bbd3d709ec5da3da33fb24b6d4d894a5cf4d9b0ba307f1508a8f1542874cae27d2fc887fbe5d8c05
- SSDEEP 3072:9+3HPoi/Mk4HyKJhQ7gOmAaTA9KvLNetWdrR41UeE:SAi/MTfPITO+KhetqR4G
- TLSH
  T13BA30282708C6DA45FF1F51BD29AC70D03046C1BB6D5A1982FE50E98C7DA4FA7CB2B06
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  shhh/Toon Boom Harmony Premium & Storyboard Pro v 24/How to/install pics/Screenshot_8,1.png
- Size 17KB
- SHA256 340be662bbc8ebb62c924312cae564d3fd38a2f4a0a7c5da99c01003428fb3eb
- MD5 0e55ec3fb71e180f0495396f143031eb
- SHA1 99bc730d1520ca680d8797e3d81b85b86ea0dfe2
- SHA512 a32f4ee94247d2844809bcb19f2d5cf98c08880009d19300cfc6da2f28e78f37b7fe12c4a736aab7e835426ef525f6369ac406af8b3a9e1160eeb2bfb6df97d6
- SSDEEP 384:mkllFtletF2e4NIMV4GXZMiOldDP+sX3Kv/qSgXs:vj8F2eetVD6VldjVX6XqSgc
- TLSH
  T1B3827EE11811E2C5B553FEA6D6AE14187E1A4C53B3992BC3447CB4E13225F3919DCECE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  shhh/Toon Boom Harmony Premium & Storyboard Pro v 24/How to/install pics/Screenshot_8.png
- Size 29KB
- SHA256 4017a5a330d602952521699752044b3a48daee46cf4fb6ec4d42f688fccdd29f
- MD5 45d6e858fde1257e16ad297492b2a035
- SHA1 17b88d7bc1a27ff8eec0af2dfefd180acb667dfb
- SHA512 e32ca6b8b97cd3f0ad5f5c46a204f545059420dc5d91cd388b38558ceff73dc8b338966eb1d84b5576afae9ca3e17e8f5b00e592511600389d6168c0cd1dd16e
- SSDEEP 768:EmRwdpuXH8s/Hwpv1+1hKWUqFZyzPkxdBn8e:EmRwdpuXH8s/Hwp9+1P5ryDoBn8e
- TLSH
  T1A5D2C017C2B0F495F692B375B682090DA85F3C66C993CF301299CEF45F930A849DEA58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  shhh/Toon Boom Harmony Premium & Storyboard Pro v 24/How to/install pics/Screenshot_9.png
- Size 31KB
- SHA256 bff64912bb4f630f30ae85374e2571e31d41bc4f5ce914724be7966f6ebf7687
- MD5 79d0f40f831d2ae46df82b45394774bc
- SHA1 7f257f2e756dcdcbd907c41045ca91fa055d789e
- SHA512 ab89e38d9b5795fab6598869363d8eff10e5fa2241085211a2b71a28bce90a6b56240bcbb3f95cad9f8c66c40d76f8b6c195ac0c4d9d9e1cc9a5b9aeeadbe7a1
- SSDEEP 768:5+KPtKvhIPV1yYVRn4DglzOdx/Mo3sloAkgeJELl6+6JVy9wo:5LUpYCaiDWzOdx/Mcsl8fJGl6+6JVm
- TLSH
  T1F8E2D0431A121F6EC5C273615D7A8A56884F6C65E7BB88DEFED348B4348CD3B0570916
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  shhh/Toon Boom Harmony Premium & Storyboard Pro v 24/Toon Boom Harmony Premium 24/HAR24-PRM-win-23019.exe
- Size 555.2MB
- SHA256 7c4708d1c6dd413ac502e9f006920585311c976ade74dd3594eb74dc7c705268
- MD5 82ef7be5070d00b7e64b9888260c9cb1
- SHA1 e07bdc2dd066101ba31630e5c107296b88aaf813
- SHA512 647e7459ca2caeb04f42ff0cbba6de11ef8375bf187e9a048f5414b83dec283caf094af4d54f60fc5c1b1d2ea5a65cbfe169baa55dad35b5c23713bb25e2e734
- SSDEEP 12582912:h0bTTm11MSFYp/jhu7/DkU/MZUj9ZqmMK5HNC/JOcnG7b9MgAd0/:hyTTTdYD119Io5tKNneb9MgAd6
- TLSH
  T1D9593345D285507CD1F1583EADCF8DB4742E69738E50D28632B4FE2A4EE8642390FB7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware execution persistence ransomware spyware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Executes dropped EXE

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Badlisted process makes network request

Boot or Logon Autostart Execution: Active Setup

Drops desktop.ini file(s)

Enumerates connected drives

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32