2b82638ea306cb14306317906c8671fbc353f033dcb53daa850b5dd33c0b14c2

Sharing

Copy URL Twitter E-mail

General

Target
scripts.zip
Size 91.9MB
Sample260727-d19plsgm81
SHA256 2b82638ea306cb14306317906c8671fbc353f033dcb53daa850b5dd33c0b14c2
MD5 9efa94f11af660f68fed1e9734e1e3b1
SHA1 a824b596572a0c7b392bf069b2820161040c9929
SHA512 4de78fce37dfaaf2e90057ab53a5d82580f7a1276c0e819491dd22f79de2295ea361647dfb3b5dcdb5aac9adc8032d477d10e78079b052d24f74ab491688c423
SSDEEP 1572864:C84Y2BHd4C2MA7BLxeYhP6DM63p0PmqicJlBcEBbPCQrTu3IDEqrVIX4MtE6pFCN:4HqxexD3pslWYTdtVSFKyzrN9pg/L
TLSH
T17B28339100F38E43718AF2072BED29D7D151A628BC2354196F949BAD289F3F74D727B1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  cpro.exe
- Size 8.8MB
- SHA256 e445610dc7b68ea16a0c56d3bbdc94bbfeebe26e950d57c2cf248dc1bf90121c
- MD5 02364ad61133bbaaa51b6dc1589e1841
- SHA1 32075bfa6c704775f205e0c32cb2fa64567892da
- SHA512 ce27abed73b04afaa99f7af4e8235a2abfc66fa882b6aacc9be1b6a431b980ce6405158c65924edb5d511cd59215da0e11162706acb0f97180c9efff91dcdba6
- SSDEEP 196608:pyjntbW897G6x7eovq5XMP6PzFcx97WsHsoq1bRjMFn:K1bdq1B7wgsHsoq1bpin
- TLSH
  T1A196335512E105E6F8E7F13D1AE2E166C272B8102B21C5DF17E04AAB3F5B2F25D36B81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution persistence
- Loads dropped DLL
- Creates a new local user account
  Uses net.exe to create a new local user account, often for persistence or a backdoor account.
  persistence
behavioral1 behavioral2
- Target
  cursor.exe
- Size 13.5MB
- SHA256 f29ff201bee124e86aaed7573ed9a2ea9908bc54531f13713336e2f5a5656cfc
- MD5 5778cff04eee694d5d49327d88c39cc4
- SHA1 d5708c416637ef76020f31dca39f43eeb07bb10e
- SHA512 59d58fe18d79b23906e029d2befa70755c418e35589f425e6397c601b238152c297ce89fa46098410df53ce60177f2bba5814f126b376d827bbb7221194547dc
- SSDEEP 196608:j5A9AAETDptbW897GDr/x7eovq5XMP6PzFc3W1/zMkJ97WuxAHskNqSPrGyZRjMt:9FTDp1yNdq1B7nrhJgBHskqSPLZpiAC
- TLSH
  T199E633C123910951F99EB23C1AC496A783E1B4201B61C9DF5BF04EA63E572F6EF35B90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Loads dropped DLL
behavioral3 behavioral4
- Target
  dcr.exe
- Size 8.8MB
- SHA256 d8aecaf95bcbf3f5083a4355ff025e4f0c767ed2a6bcb8610c93125d605e2ee2
- MD5 fa226b46ca58c9b75708c5411d75bf49
- SHA1 73ff2211d52323ec60299130d914028f7a26debd
- SHA512 7019bbf99ae29a7ffc2add21c47ec43e446daf7ac3b3d6c1f1d1ce1a8e2b29ad3d1d9eeb23bb0c6454fd63d311396736d45b236cd174ab3990d7300c5d7dc36f
- SSDEEP 196608:Qf2TQtbW897G6x7eovq5XMP6PzFcx97WsHsoq1bRjMFn:1Q1bdq1B7wgsHsoq1bpin
- TLSH
  T18796339513E105E6F5E7E23D0AA5E193C772B8106B12C69F07E047AB3E0B2F25D36B91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  dialogs.exe
- Size 9.0MB
- SHA256 8dce1c028b61e9e3ef30fc227e6d4d01a09ae2879c0d6e3e0b77e63acc31dff7
- MD5 e158a3f6fd1020ec26ff084e87ec220c
- SHA1 a5c06ddeb73c931d9e72b91dce5ea4dd4a0928d5
- SHA512 36b2aeb0a25e75da96858ef1d0793a9b89ad9b660d0e834bf829a641468fd0bd1da744c28fc5418a7d7afe1c4517bd1304c7797d63cc18f9298a713386f26bc3
- SSDEEP 196608:sWKtbW897G+x7eovq5XMP6PzFcx97W0HsoqYbRjMFb:C1Fdq1B7wg0HsoqYbpib
- TLSH
  T1BB96335513E105E2F5A7F13D4AA5E1A6C262B8105B22C9CF1BE4876B3F473F21D36BA0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral7 behavioral8
- Target
  editor.exe
- Size 9.0MB
- SHA256 b9498d6011c75e9bd8724129c7dc7206319f3c6e6f4c581c90ab4493d65a9364
- MD5 6bb0145326de66d29eefd074554b0136
- SHA1 57eee73e519d60a9f56c72c90e29475e90a0f284
- SHA512 e5f7399da29bcb203d5edc08991a22dbd87bdb6ebd312f95e2d695786661297aab7f04828265d0f2c0bc299fa2ce191a391cd594198ae7a683bd956c83f02eb8
- SSDEEP 196608:StmtbW897G+x7eovq5XMP6PzFcx97W0HsoqYbRjMFb:L1Fdq1B7wg0HsoqYbpib
- TLSH
  T15096339512E105D7F5A7F23D4AA2E1A2C272B8102B12C5DF1BE447AB3F4B2F15D36B90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion
- Blocks application from running via registry modification
  Adds application to list of disallowed applications.
  defense_evasion
- Loads dropped DLL
behavioral10 behavioral9
- Target
  gdi.exe
- Size 9.0MB
- SHA256 64b4d5583bbfc1282e74571714a8a97159ce7dd2ac25044b3c4c9d320e118271
- MD5 849bb8b01b72294aa1941dd948cc70b9
- SHA1 b0aa4d300e8996584cedaefa3d2378f84e3d64ba
- SHA512 8cffd0d0d8fc558240d98f654ad39d9aca25f3f4cb7cd83e41977d72d3a81cc04fbd7c890d128e4648f3717ce513ab6b8278c3f117312ed67f5bd96a562ae6e0
- SSDEEP 196608:RGvsDbtbW897G+x7eovq5XMP6PzFcx97WCHsouYbRjMFb:Osn1Fdq1B7wgCHsouYbpib
- TLSH
  T14096339452E105E6F5A7F23D4AA1E1A2C262BC102B22C59F1BE4476F3F473F25D36B90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral11 behavioral12
- Target
  hidetb.exe
- Size 8.9MB
- SHA256 880b5ed00f395427da2b3556b44ddb0ddf761cc80c5fdb80cfb1256f5ded830a
- MD5 ebdbc2cd35fb5c374c86e959e60d15cf
- SHA1 902fbe577886a6b266319e02fa82cfacaa9358ce
- SHA512 a13fd4916ebd3df1d962e783eb6f142823e90ee65669f51ea1a8d60e90e28bedf8217976cc17d9d9356d7e8895ed6f6aa1ce74238b729e1d6a005a3eb8d0966f
- SSDEEP 196608:ohV+ktbW897G+x7eovq5XMP6PzFcx97W0HsoqYbRjMFb:M31Fdq1B7wg0HsoqYbpib
- TLSH
  T15796339552D105E7F4A7F23D0AA1E1E6C672BC102B22C59F17E04BAB3E472F25D36B90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral13 behavioral14
- Target
  input.exe
- Size 8.9MB
- SHA256 4873d1c9ea06cea3053cfd3e5fbc7c381921924d88de92a3903c0e3ee11c0007
- MD5 5b902ac4ad5ec042dd8dddffbd536c7a
- SHA1 b43cef91edfb8cd07c2179a7e572675598b0280e
- SHA512 a00f4953bfbb64727a6c7a5f40ba63bc327ca3c9bc86814facc8e4b9835dc545820ff5866cf7d9285af5179de172fb85b2487e264101c8be75ae363695dc5553
- SSDEEP 196608:KaZFtbW897G+x7eovq5XMP6PzFcx97W0HsoqYbRjMFb:XF1Fdq1B7wg0HsoqYbpib
- TLSH
  T18296339503E105D6F5A7F23D4AA1A1A6C372B8101B22C9CF1BE4876A3F573F25D36B90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral15 behavioral16
- Target
  keyrep.exe
- Size 8.8MB
- SHA256 feea9c83d21538f45dc8ee2210d2b1f4efb1448e404b123c91ac36dfdeb4ac12
- MD5 a37465b9c731a56fc4eccd1186d1f8d7
- SHA1 7ab9aafa940c654e16af4ee850003de3d734637d
- SHA512 176ac0b860093926d10a796543528f6ddb17bad6264360021a5eb1270d0af66e65375679a2aa64ad383c5326df87ca6bf8d37b71513c649c8b2ff44a432d7f19
- SSDEEP 196608:whQptbW897G6x7eovq5XMP6PzFcx97WsHsoq1bRjMFn:jp1bdq1B7wgsHsoq1bpin
- TLSH
  T1E796335513E105E6E5A7F23D1AA2E1A3C772B8101B21C69F17E0876B3F572F24D3AB90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral17 behavioral18
- Target
  mbr.exe
- Size 8.9MB
- SHA256 b7cd90e9437a1244385323ee39901e70af5283123a12173bf95039bc67f3edb0
- MD5 e9663d002d53638edf1e9938bf89c758
- SHA1 8794e085d9b6a9cdbfb49a6b68bdd6f73a6e366b
- SHA512 4f31bd83361abc77eda55fa156b0018ed527710f09ad03501a9ab833c64769fa7f48f04a1fc22a4c0ae9aba6eb4438f09806bbe3346e575623fb88e64f9b25e2
- SSDEEP 196608:JCUCtbW897G+x7eovq5XMP6PzFcx97W0HsoqYbRjMFb:41Fdq1B7wg0HsoqYbpib
- TLSH
  T12C96335513E105E2F5A7E23D4AA1E1A6C371B8106B21C9CF1BE047AB3F5B2F25D36B90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

bootkit persistence
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Create Account

T1136

Local Account

T1136.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Creates a new local user account

Loads dropped DLL

Loads dropped DLL

Enumerates connected drives

Loads dropped DLL

Blocks application from running via registry modification

Loads dropped DLL

Loads dropped DLL

Loads dropped DLL

Loads dropped DLL

Loads dropped DLL

Loads dropped DLL

Writes to the Master Boot Record (MBR)

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20