77c374608aa9dd66acc3be8776a5a4f773e9409b583cbc0fcfdb4a74b85d4084

Sharing

Copy URL Twitter E-mail

General

Target
PvZ 2 PC PORT 4.5.2.7z
Size 599.7MB
Sample260724-frm6csgm3s
SHA256 77c374608aa9dd66acc3be8776a5a4f773e9409b583cbc0fcfdb4a74b85d4084
MD5 752ff6008c4b34e05329d1f7abf1f8da
SHA1 516b3b67d23de9052ab190366485633b2448e044
SHA512 c822ae5138191037ebef4469095245eadfd5774e57b75f3c2e140af10ac39b6bd5dfe6ae3f27363989c70d69b4cbbdf8043bdf62bb1c7307591347249a37f4e8
SSDEEP 12582912:kzYDqY39dzcrn1SldsofWeJwHLdRnEB5MIbPFhQjYFrkI1swOGcPMZft6LFjJ6Xn:Zp39dzSQNfWeJepgFSY1+hrsfta6NOi
TLSH
T11A693345E9038CECF42700374C9B2BD83A345D1570E66523561CE2FA9E7FAE49B1B2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  PvZ 2 PC PORT 4.5.2.7z
- Size 599.7MB
- SHA256 77c374608aa9dd66acc3be8776a5a4f773e9409b583cbc0fcfdb4a74b85d4084
- MD5 752ff6008c4b34e05329d1f7abf1f8da
- SHA1 516b3b67d23de9052ab190366485633b2448e044
- SHA512 c822ae5138191037ebef4469095245eadfd5774e57b75f3c2e140af10ac39b6bd5dfe6ae3f27363989c70d69b4cbbdf8043bdf62bb1c7307591347249a37f4e8
- SSDEEP 12582912:kzYDqY39dzcrn1SldsofWeJwHLdRnEB5MIbPFhQjYFrkI1swOGcPMZft6LFjJ6Xn:Zp39dzSQNfWeJepgFSY1+hrsfta6NOi
- TLSH
  T11A693345E9038CECF42700374C9B2BD83A345D1570E66523561CE2FA9E7FAE49B1B2AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Executes dropped EXE
behavioral1 behavioral2
- Target
  PvZ 2 PC PORT 4.5.2/!!LEEME!!.txt
- Size 562B
- SHA256 116b11861207bd816687cc92d54fc250bfed6c7c726d5b0ef0ee17ef704d8bd1
- MD5 5cb8d4fc1609944292887a986db039c4
- SHA1 679aba6005cd0ccd5c0cdee1d84e3a1aee4236f0
- SHA512 83d23ac21203412e1f0b056fc8352a1bc8a05f9aa948b5fd7adb17d12984cf8b9a7accf442bcce7748df4a39394b8e0b9828515eee5ee036d64bcbc4f650332b
- TLSH
  T1C8F0C02498E4837D31F56747728EC567CFCBC419059DC397A071892510C9CA5D229A7D
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  PvZ 2 PC PORT 4.5.2/config.ini
- Size 1KB
- SHA256 276b47ea18e78f4639a8b1a86fa132711f6417db391bf9144a7c1855f720ccc6
- MD5 2215dbb50610fa396b48210b036ca0a3
- SHA1 663c7525be4ff2e305921f8152ad8e32da61f313
- SHA512 dd0f3862d866f3401687d9f12d8d8bcd79a7cd30dd28db3e1878d9cbbdb438f125ce2e987b7ba8b87ddec5991c869de6fc5526e358eb32c5ac9e2887954d3750
- TLSH
  T1973194562763177228F5B7A7E41C27D49F28C0C40C22F9A06946D118261CEBC82743FE
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  PvZ 2 PC PORT 4.5.2/lib/main.147.com.ea.game.pvz2_row.obb
- Size 626.4MB
- SHA256 aa76069dd3f5120cdf733de5e9b5946eab53d8bfdaccb4cb06bdd92bc0aa3abe
- MD5 871ad0d1313bc15d4944290679c32ba5
- SHA1 5383da19b1ee0e7d2b702769474a0bd5e126c1cc
- SHA512 37fe42615fd5f4402b2a6c273e05482157efab60342cbba1c9ff3f29997c64d50bda63bcd3a293e65fa0db46943c9248f779229bce6bda5a02e7913d030741e9
- SSDEEP 12582912:r8oeYjMgl6eovaQ1xn9k7onVnsX65pFt4UTMvylXmq5Og1lB2PGDiJ9uHIQ:lNglFHhIyNbsx6l2qhx2WiJ9E
- TLSH
  T1A26933A5D092D8C2F61B28B5C6D19E96F7B3F1A041D105C38EA8B3195D2F1606F1FF8A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  PvZ 2 PC PORT 4.5.2/optiprojects.asi
- Size 234KB
- SHA256 214cca88dbe770feb8aae9001973e0cd918770aca2572336d3962b2d1795fe65
- MD5 47e823bce00a72595916e9e18b1fcc00
- SHA1 7e2bdb2b1a6c23160b4b1efc2f57796b02612749
- SHA512 3ae1b5d24be65531844b1df4d8f67f6302e79c35d118a4b8567dc7fcf2c8693743835355350dd0aa6b6369ce1aeaacbd144fa333bc3df154a3e8e82da7af6890
- SSDEEP 3072:X2wlZpZJYQ5FwdJG+JOeoMlsPHLOWQmfn6hMzkhuwHmMEHMuqGivQ8MWALMj8n5H:mqoQ5Dza5AGNMAj83cykTZW+W
- TLSH
  T184343A3AD773DC78C53B82B84BD751A2F430BC260134A19E4BD4AB323E15E709B9A5D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  PvZ 2 PC PORT 4.5.2/pvz2native.exe
- Size 15.5MB
- SHA256 e9f77ce8c9d513a27efe61136947e40a8825a4ea6449131ac99c9cfe87b80523
- MD5 49f5a60294b03d724e6ef5337b27c77a
- SHA1 1a7778149a12fd60281929ebeb4fa07f117905a5
- SHA512 6f1448ea70ad98c47299e4744c21b5268dd4996fab7c15ef91714d19e122167e3d70bd7a4ce0a5b1709f1498513d5b4e5d6a7f032c5f4a74b8b451cee63ec1ae
- SSDEEP 98304:wPOzy5SF2MxEtqtOaCp3WxDhzwc4DAXnroRuShLlTSuuqqXNL8U3By1rC9HGz5hb:EvFQCp34SmSqdYVC98L
- TLSH
  T157F66AA3D2D75C9EC859A3BD56A323316338FC0146715F6B3D48CF606E63AC1358AA2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  PvZ 2 PC PORT 4.5.2/winmm.dll
- Size 335KB
- SHA256 17a6c08ff54986beec783578a14e11b374a0bfbd547f29ee8c503ba9bef74e6c
- MD5 cc0c545967af1f72122c35b23eb7bc82
- SHA1 c8c9701d1f2ea8686b497703ba081b64150737aa
- SHA512 9ef26b9f864a45cb874c15d99dbe7ff5a7b080e1ecf35254c49b5969aea5028fd70693cb8bc99dde743cfc18186feaf2845f8c8f7ae9e0d79432d29dfaaee0b9
- SSDEEP 6144:mBirMDSZQMmXZGO/di6nAr8Jnh4Hw45DoBRmuiebTJRQ:eaiGodi6nAIJhDhBRB1T
- TLSH
  T13D745A857B9401AAF977807C8563CA0AE77EF9454320A6DB23B0469D1F37FD8893EB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Boot or Logon Autostart Execution: Active Setup

Drops desktop.ini file(s)

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14