f0922b350fe1e7b6a7252f8963a94cbc02e28319c9b342cb5c1e48bd11fc9085

Sharing

Copy URL Twitter E-mail

General

Target
189-1200320F_RWR.zip
Size 42.8MB
Sample260723-vm19ra1ybv
SHA256 f0922b350fe1e7b6a7252f8963a94cbc02e28319c9b342cb5c1e48bd11fc9085
MD5 33056a0767a871e3320032ba8adb8617
SHA1 168a18981543fdfad917c0fbc2b9851a0c946117
SHA512 9bf14d9bb0cc9986964d28086fdbd1a1a326c610f41000613b1485c9d145f5f62d45bf048b3a16f5fc4b0c41a27bef80e20158bcff6a7c07b4fcdcc32898a352
SSDEEP 786432:DvQLNxYQSCUNmReYwWBEU+uYIOOlvGmyVzV2scBXLSNgG6Ar9+/a54ZA6vu5u:DiCGXRLHx+uYIvlRyVx0iXrP4z
TLSH
T1DBA7330682F9B4B362C6863AC5065F01168C7A543EB7940AC9B5EFF7D1A63FB606CDD0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  PCLoader/NativeUSB/InstallNativeUSBPCLoader.exe
- Size 2.6MB
- SHA256 d121db33f0e1db29470823e2a7a24b84c589de5e9c2d326d4323ef28a2facc11
- MD5 bec5bd206527af573943b2815bab0275
- SHA1 27146bc211dd8cf427ab8379d25df3aa951a8c8e
- SHA512 a1bdf679a47621d81a36d2b4da74eb0d1bc01938a40aabc507b847d91e849cebc7385aaf7077736e1584cc1fd7e64a71f4d1ae14bbd858feb8964eba31615a7c
- SSDEEP 49152:Y7KIzyhh5Oo0wTbFzZyfwQnoV4xFtT+emWyN1Tgg7G5l7PcrNDlru:Azyhh5Oo7ZwNnJD+eyjUirXru
- TLSH
  T101C5D01376C1C03FE2A215328C6F9EB446A57C235A31465B7694FE3C2EF4592B923F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery ransomware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  PCLoader/PrinterClassUSB/InstallPrinterClassPCLoader.exe
- Size 2.6MB
- SHA256 72c798bbcf5fe53a2d4a640ca7dd7b9ac207bcb9e8eddc079518a7bf17475ed2
- MD5 7dea599acaf29eaf0eae733bcc5fe244
- SHA1 8a4482fbdfc7c2b32bd25f5bb22f792f6c845746
- SHA512 27bff254d092516c60bd41ecbb02bc4c0912ee08a7ad3fb78e38f30365dbc3efd9cbb31b4da401969b06bb236c00caa91f90383cb07d137318e5afe190cc7937
- SSDEEP 49152:I7KIzyhh5Oo0wTbFrZrT60gig4OtFrecqXwlYHi3azWCZLCxDWFQxO2c:Qzyhh5OoDZr25GOtFr+AlAjnZWxDKCO1
- TLSH
  T147C5D01376C1C03FE2A215718C6F9EB846A17C275A304A5B75D4FE2C2EF4592B923F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery ransomware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  PCLoader/Serial/InstallSerialPCLoader.exe
- Size 2.5MB
- SHA256 f9154f2279b942d6f5a751ebd48a71b6ecfca1183d6cf32ac65d57d62a001b7d
- MD5 34a93fc3aedd35862389854146822ac5
- SHA1 4340b7c78987f4fea4d06f001038266bcb9d5214
- SHA512 bafe0e1af82050a021e012d07c9796d806f4f8ec85d76651230fd08a4fd0e29d0b9298af0585dbf68d19ec28d48da05a0e381054a83a1cfae4367ccc5c53f597
- SSDEEP 49152:o7KIzyhh5Oo0wTbFLZQd30coytZguXCouU35jbRpNtDWsS4GI:wzyhh5OojZQCDMguxuUJPNtDWsP
- TLSH
  T112C5DF1376C1C03FE2A205718C6F9EB846A57C235A30465BB5D4FE2D2EF4592B923F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery ransomware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  ReceiptWareRetailUserGuide.pdf
- Size 5.0MB
- SHA256 29a2da06048c0857c17a4c3d8b1dfbc43837b4cd60da117431d62afc9c073441
- MD5 8549df4bf7dd2649be97729701cab114
- SHA1 8452d4918be6173ed855f8f870ca7aefe77b8f97
- SHA512 4aab6d2ddf4c495bd845ac496ea3dcff052277e1f65a402c24cb945a8e4f4081771c8a3746b81d7c41e03cf52d870b69f111f77142984ecafdfd558f819c6551
- SSDEEP 98304:LK66ZJosNouJ1S5MCmwuZRebpSG9TgAc/oDK3KVMfdcf7zENN:56ZJDNQ5npiG9Ta8D3ENN
- TLSH
  T1DF368D143777E49BC14D12187DF36E382E5EA2A1A385F180BDCDEDD8FB8A511289693C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  SetupRWretail.exe
- Size 25.3MB
- SHA256 284b6e39b671b8d266bf0faa5d546da2b5ed11d145606c10bafe33cab890de72
- MD5 34923fe654541e64fef415cff059d4da
- SHA1 2a385c89fa41838c9a18d49afafe14f72a12f8ae
- SHA512 eea89c2d2d5d90c074153b76aaed364381dbd3f1e1805def0008e5d2ffefd8a5ed7cf1a1c4630b9a0685216d715d89dd9ef6956e0c91d3d8c79f96dbab564c9e
- SSDEEP 786432:v11qnOVw+joB+dLswJRT+Z4cCcf/9XYXs5i8Nu1j:v11MOPoB+RQlf4s4j
- TLSH
  T1C4473306E7F7447EF2E20A72993709510A8ABC347B74580BEEB19793DFB61F59028760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral10 behavioral9
- Target
  TrainingGuide/ReceiptWare Training Guide_sm.pdf
- Size 7.0MB
- SHA256 92e93f5811059e134fc8991ae7c359b0dbfe5fa6ecd7db8d4ae113994a561ca9
- MD5 80c391a1ae16b6af3f6c8d6ecded3d45
- SHA1 db9171baef5fcd335207834cd54a1ede9a4b68cd
- SHA512 ef5451bde588ffcc0160e0fdc3d410c9aed68e6c128c7340f5977d8c125aabdb2e0c49da0470b045057bf0dea4813781a2629e5a8bed4bce3763424e46a7e6d0
- SSDEEP 98304:skr+snGVRyfL1c80yJzV2w0b0dBxbbV4MzrREUTYhi+wu7RQXISYkHNWlhNjsNHK:skrPnQ1zyzVBLBxnVqhi+UISYktAHAij
- TLSH
  T10576DF283773E49B954D12186CE3AE742E4E5292A349F284BDDDFCD8FB4F5002C96978
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  ASYCFILT.DLL
- Size 144KB
- SHA256 de83c9d9203050b40c098e4143ef8f577aa90016c7a64d4f2931b57a4c43e566
- MD5 c89e401800de62e5702e085d898eed20
- SHA1 72fb4f088c6ac02097b55fb267c76fbf5e0fa1f7
- SHA512 70006d70dcb47361ff43e4f7c458655ad2474b70cb917873aa77d2cc06465a68d375d36c494d154a03dbbff891df7dd6cab3d2c7b08e8650b9ff170e30838070
- SSDEEP 3072:h+qD1Cd/Oa5kXFlqkFGr3CAP7LCyInPEggen5Ez:hlCd/OaaFEjCAPKyOE6na
- TLSH
  T12CE38F53BA1140F1D453127919BBEF768F39A76A027BC6B383B0E4711D21271EF3929A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  AUTMGR32.EXE
- Size 149KB
- SHA256 fd36273aac6a9fa6db4210f292fdda4c44139d954f4269fd0cbde1ad15265259
- MD5 8235bdd6d5a57063305dc153a65dff9e
- SHA1 a16a539508556943652abc69151e71ff76fa4e00
- SHA512 f4ed917e821a278f45b38c0ed6a27426562d071aa8831e769c2d398c08382336841d52c0af1353ab1cd2ad626e397d9a73fed9b694feeb43ef7204c606b6f867
- SSDEEP 3072:k2HftluSq2lCxWh6uV7ZSOqYYup0n7uBJ:NwMdVSxu+7
- TLSH
  T11BE35A72E1C39AF1D5D787BC01A2367F6A3B6A504392E5C34234386569F36E19A383D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  AUTPRX32.DLL
- Size 137KB
- SHA256 0563e77b6bd63eb0561f6264badb5d07dacb7287ce029dc3ca3279a964ea6a6d
- MD5 6e62806f4121eed119ef7d361f3322ca
- SHA1 2265e83e068fd0bda58d0ed8366050614138787e
- SHA512 fa5efb12fcd7d34a026b95a573c5a8b72dcacfa0c3df439e55691f27c9c0d8cd8905f0d3cad610259b9bdac474a3ed41796a91474e0ab522e78d8a2cf2a53dba
- SSDEEP 1536:yTChuEXZnfAdeegEKMK53sORozp/pzbcsXG7fPKvKqRwYKIr0k7kZp:yTCUEXdowEc53sOc5b+n+05y0k7Up
- TLSH
  T110D34B76E1C3AAB1D9CB873C05E73A1B563B6B9087D2E5C346307811E6F36D19938392
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  COMCAT.DLL
- Size 21KB
- SHA256 96d04cdfaf4f4d7b8722b139a15074975d4c244302f78034b7be65df1a92fd03
- MD5 3b180da2b50b954a55fe37afba58d428
- SHA1 c2a409311853ad4608418e790621f04155e55000
- SHA512 cf94ad749d91169078b8829288a2fc8de86ec2fe83d89dc27d54d03c73c0deca66b5d83abbeaa1ff09d0acac4c4352be6502945b5187ecde952cbb08037d07e8
- SSDEEP 384:23Fob3slaN3oF1fHICOoMzMv/QTIBjDVquODJXsUW7ftWs6:Yo7s28JnOxzMv/QsBjRqugXspd
- TLSH
  T13EA2F992B7BA9013F1D201B5182DF317B3B56B7009ACA15E8324EE5E24F94535B7872B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  MSCOMCTL.OCX
- Size 1.0MB
- SHA256 bc58d624ceea02ab086f1cce809c992bf5a7105e88931853317a2f5aa5afd6e4
- MD5 ecc7d7f0d3446de36045d1d9e964fafe
- SHA1 da6b0ec081d628c33b150327f3bd16d3b7fa4729
- SHA512 443de697be9886cd97235e6468f3a7f6bf11612711e54dba31431b0d9418672e1434e839ed50cacf28107f692f0c9d9d2f57d90e3a843d81015d459c180db632
- SSDEEP 24576:s0LiK1d6dxOehwsj5dC33M/jYVRDSfaF0gg1CVGO7oVtNKG:n6dAehwaY19G1u7+Ln
- TLSH
  T101355B0273E58022D1B726B0197B37B5ABB67F619D38E94F1B503A0E2931E81DE35727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  MSCOMM32.OCX
- Size 101KB
- SHA256 51a1d6812e445c26c71465e2709e6d1ad587f8513002d662cd160f424f48b37c
- MD5 2c6119da3993f410e74b15112f840cb0
- SHA1 9d7aaffc0bcf955cc75d4ecc228b1ceda8a1856c
- SHA512 053ece4eb2ddba51c0d683a7afd439ed88605ab83619de738f7ad2495bfe9e9f16fc3b829c7fc9c779b50f039b9fad66d16aed520a5adfd1522a711073f78208
- SSDEEP 3072:zsQgdI5Hh8p28XMehRYSdB/TYDY44UGyGfDnfra:zdgdI598jhRJpYDY4fefna
- TLSH
  T1C1A3184273F69123E2B327340976E7A5BBBDBD612C35959B974033CD1B32A449E34B22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  OLEAUT32.DLL
- Size 584KB
- SHA256 baeb2f7c1b8be56738d34e1d1ddf8e0eebd3a633215dc1575e14656be38b939d
- MD5 7b156d230278b8c914ef3f4169fec1cc
- SHA1 6b58e20b2538cb308091da838710f6aad933a301
- SHA512 e4ec2bc714069e0a6b56d89b52aabad92e5ba741dc6f26d2fc2d72aa9ad2ec465dea523cccd810331ab78b5fb8a1244b2b521303418ead5bd6be5a58b43794c5
- SSDEEP 12288:HCKynQWKglDhrUtrvT/NInIk4NDXsR6lMlpGz:HGXqB8V6lMlMz
- TLSH
  T1E4D4BF73B6C6D0F0EE5330794912733BEB7613161096E547A3EC2F962972442AB2E3D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  OLEPRO32.DLL
- Size 160KB
- SHA256 789c3c45eda1749bd939f4a96616e1e9ef1b7dcc62a2889f65088954c64d0938
- MD5 ce0155405ea902797e88b92a78443aeb
- SHA1 8adff69050d14a57d7f553ca8978439af188c192
- SHA512 3fde09067f9ca8d315de07c8db972f99723ea4c3f997dc58210f9d6565caa9935c79f13e8b2d20adc5609919a381e4c2a90a0b3123a35947997229d7c615e162
- SSDEEP 3072:+VrhrwLXcA2Ha/joWklbo/Acjwm4AaW7zozn/zgOh0Z76:fklbsqmyWnoz/P
- TLSH
  T1CCF35BB17542C0F0E60230392896F7B79F38BE4B4E969343B764FBAFD972242650D256
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  SETUP1.EXE
- Size 244KB
- SHA256 5b82b27da9bbaae1abc32095942c60017b275e002cbb2c0cb44580131f4789b4
- MD5 c6264b17629f6f9f0bd2ba7671ceff69
- SHA1 67a6b419740c1d6b780789bffcfcc83129e36d1b
- SHA512 7ebab7444620146a065b520491faea53612d627ae85dfb4bd92201864e5cdad55fe5c94ae66a8c7a3bf7950a60c54c20b9291a70f3801e937711f1b596543f1d
- SSDEEP 6144:ss+MamfDqaBv6xdnG6+hdbHSHqFJJe4XZ1v:sC1H+NG6+h537n
- TLSH
  T16A34E72263E47B56F6668BF05D760654883ABC3149B0D90BA6C21F0D7A73E43EB35327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  ST6UNST.EXE
- Size 71KB
- SHA256 dafb5d89135fa565080c9c6beafbdeb7611089e946a520001a7ef02facb002d3
- MD5 ea4e2ba0d35eeadee23b0c1397c71367
- SHA1 e715ddf7c568a745e7990534f06460556e20b3ed
- SHA512 64b1521c1d03683479f41f27b5a4feb4a703b70f8db45080d74d14ac1747c8fbd393adfba3b8c96748f8bc6a4bfbce00d12c44ebc1bb7285d5cf7528f5c7ab86
- SSDEEP 1536:JGTJG3gY1xqNUi8tUUoC2RjJ/j8a6tgy7/G:09Sx8UHUUoCcj5ktge/G
- TLSH
  T157632C42A6E848B3F6F1773024F667759A36FC1B1B34C6AB9350D9BB1C32640D92931B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates connected drives

Enumerates connected drives

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Drops desktop.ini file(s)

Enumerates connected drives

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32