53fd53114b25aa451b251216f116b50251c1f8c113f2fc299a16e24856be4d58

Sharing

Copy URL Twitter E-mail

General

Target
WiitarThing_SCP_Driver.zip
Size 9.6MB
Sample260729-cdd4ratycz
SHA256 53fd53114b25aa451b251216f116b50251c1f8c113f2fc299a16e24856be4d58
MD5 c2d23ef91edd62cbfdaa441db351382e
SHA1 d54f8b5392b5bfea7c9a939745f35a8a8c69fcfa
SHA512 efb3ea1b130ce3c33e5d9979a14ae1486dd1098b1f92a93f951d93201261f53a4bc1529cdb7d9d95ced4621bb49524744add1505fa94f5bb7df0206c479b2b03
SSDEEP 196608:hqlMHGizoFi5d31otQveiqCG+d74tXvv1+Wegva9oav+kgUzASOGqK8vsGOP8tO:hqWzz4gd31cQUtX1+qaSa3Z8Sd85S
TLSH
T1B3A6339FBB6106F0D1B997B5B33E44139720410D438E501AA2BB2F78D9CBD8E787A2D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  WiitarThing_SCP_Driver.zip
- Size 9.6MB
- SHA256 53fd53114b25aa451b251216f116b50251c1f8c113f2fc299a16e24856be4d58
- MD5 c2d23ef91edd62cbfdaa441db351382e
- SHA1 d54f8b5392b5bfea7c9a939745f35a8a8c69fcfa
- SHA512 efb3ea1b130ce3c33e5d9979a14ae1486dd1098b1f92a93f951d93201261f53a4bc1529cdb7d9d95ced4621bb49524744add1505fa94f5bb7df0206c479b2b03
- SSDEEP 196608:hqlMHGizoFi5d31otQveiqCG+d74tXvv1+Wegva9oav+kgUzASOGqK8vsGOP8tO:hqWzz4gd31cQUtX1+qaSa3Z8Sd85S
- TLSH
  T1B3A6339FBB6106F0D1B997B5B33E44139720410D438E501AA2BB2F78D9CBD8E787A2D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  DIFxAPI/amd64/DIFxAPI.dll
- Size 506KB
- SHA256 e70bbcee0d01658ccd201ebe0f0e547b9daff01b7c593a0fdd0c64e5f45d6f11
- MD5 1a2e5109c2bb5c68d499e17b83acb73a
- SHA1 efa15cfa23606dfc355d11580b509e768a50ddbb
- SHA512 47317d24d02c4122fe175bcd7f5b3dd8823063e7ea63f83961e40f10872642d2d6f6e6abaf5fb7630cf0e9d8cec0d112889600b14ecb8698b81597f52d54815b
- SSDEEP 6144:1uS8iJgEjHlmbGQGt20CZPbPBtqd0xYP2MJL:1u8JgfGQrIPfZ
- TLSH
  T1BFB47514FD7C1121E1A1997FE2A69E4AD17178867B308ACB0103DBB61D7B5DBC43AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  DIFxAPI/x86/DIFxAPI.dll
- Size 315KB
- SHA256 dd12d00ca9c9b1013091e733eae021347ba52dcd69173a7e5e4fd80b45ee60f6
- MD5 cf73c3a03582408d422d4f7a01190d00
- SHA1 4582875874d066e8975b8a04488422419137fce4
- SHA512 c3d82121c0535fc819329b8c6e29078f7e71245528658093ed98dd72af8af1200eede951388d938e9b27c049a0874f5cf686a42aa880da34390a72bc1112c8aa
- SSDEEP 6144:T3+rEo4fNwSQCT4YNjtMWDnYPWsjfVnnSSNbVQqbySUB:r+rEo4lWYNjJbYtdnpWhS6
- TLSH
  T115643A21A7E8C939F4F226B8147C566205BAB8705FB0C6CF33D4466D5E3AAD09934F27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  ScpControl.dll
- Size 87KB
- SHA256 446c43f3665eacdb698d46149ae172a3b0f63e6661ceca41caeb956875fb2c4e
- MD5 87c6f55d7a35f6bdb4b904598c89ed64
- SHA1 ac9337833c7c14dcb0d34deaf97b5ed12c7ebd2c
- SHA512 51efb1a8f1fd699df3a341e741fd34f7e5dfb1833c2ea6567821005f1d25a99807c27adb418827b42d43ed210f21a4706d74c8e4525c1f98586fd9574748f289
- SSDEEP 1536:PxCNdVLsJPSv0hUNCQvRWjqRIKAYG11lsETAMOpzV4oenX59sL:WdVLsJPSv0hUsokqIl1aMOVV4oenXzQ
- TLSH
  T1B3932A3427EC11A3C5BE92FEB572586103F1E2521613CBA71EC8B5FA25523814A63BF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  ScpControl.xml
- Size 427B
- SHA256 d6fdafcac326102e018cd57e33e59456ff397de5bb1bbf0f00716f5b6cd0ffdc
- MD5 40013097f94982d21e6f8725ed8e6ae0
- SHA1 d6acbd17de38fb350ae0c99f432750054fe7277b
- SHA512 095faba3ead2aa18cf13495ea12ef9e147c6ac89b4ad6654c4eb2528056fefce4641c20d93c39f87c311751a48dae0b7701920a390a91a1709947d28f533004e
- TLSH
  T155E0E5B4FFF479A1483404E5B6217BC98DD4F23A80590E65FC9699AF3A900653393938
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  ScpDriver.exe
- Size 748KB
- SHA256 7c5285e2f9058e3968307f6a9cf8fcff6d01a9578121b8c1291e42502178cfc2
- MD5 de12fc906fb785beda47efa7f608a94c
- SHA1 b9a050e1d01b9e9f279d9a64f385a74c17dc5045
- SHA512 34fd111cd80ec1edb916a6f7d6a81e8a8208afc21030083650373fc06a1562e65e8cf2261045701e88870f3fd38af02aa257c9c2c42af1c758bb24711e3cda6f
- SSDEEP 6144:oXjWsbG9zng8ULQa3AWXjWsbG9zng8ULQa3A:oXjWsb0znha3pXjWsb0znha3
- TLSH
  T173F452EDF082FAEADCC5B43868D49BE4A5E34C98BA794C63007DBE452573880DB2D517
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Drops file in System32 directory
behavioral11 behavioral12
- Target
  ScpDriver.log
- Size 5KB
- SHA256 5a1c923ea3ff8825ed7a18e4adabfe3b2960cb60aeacddc5413d1d57e6e551a1
- MD5 a1f7a3ebb9ec5d1dd82ee6b4a743d555
- SHA1 76ca3e4bee0d517388c4d230a17854ed2913768a
- SHA512 0d04742996ab2d96ce301c2f60e80429e70672322923a1a0837e0ed50772891c18297ea3f2b474213610d3cdd154d79d4f9656736d6875c596eed41c16674964
- SSDEEP 96:ean53n5Wn5Cn54n5Pn5Yn54n5Jn5Xn5Lnb/XozkX8m25IcmO/XDVZ2F+nVAnV9nS:ea535W5C545P5Y545J5X5LMwWhE+VAVA
- TLSH
  T1DFB111AF9A8684B7606B56C742D31CE1FA7D1146FE38689076DF08DCAF4E80C854E46F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral13 behavioral14
- Target
  ScpMonitor.exe
- Size 749KB
- SHA256 70d80bd67b5b3f664952c14d38e8eb004db9d1f556126d821954dda43dc92ce7
- MD5 208b4db339865d2f8c7acde359f6d99a
- SHA1 7e261268d709bcf70088188761af797eeebfdfd4
- SHA512 57851cafddb326ee335f13eb5c886fbe5b5e1afb42d5085995a793d305aec6e4cf77bd69672906d29daddc115f825a3e59b1d34622582099a943e3a19476e05f
- SSDEEP 6144:CXjWsbG9zng8ULQa3AHXjWsbG9zng8ULQa3A:CXjWsb0znha3cXjWsb0znha3
- TLSH
  T131F452EDF082FAEADCC5B43868D49BE4A5E34C98BA794C63047DBE452173880DB2D517
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  ScpService.InstallLog
- Size 5KB
- SHA256 4936c39b6c25cc2ef7990a1dad7eb89a21b9d159079d5e381ed26a5f4d795e2a
- MD5 4ed410a9c97e5befa3899dbb486c23c1
- SHA1 cb08e7e7b2774d875c4ee855371e986bd597dd19
- SHA512 d84d7023de04ef8863ea4ae3b00951c3afa686184b2b81583e7e0da7122430c602216f0dc298484a7286363848ab00ba68246718c7883e88381c3a06b61ebad2
- SSDEEP 48:8pIKKLU7QvCdpepIKKLU7QvCdpepIKKLU7ionoMoWpIKKLUco6BoyotoMomonoMB:8/W/W/h/u/F
- TLSH
  T1EDB1E78F59C726FA64E0139B5ED3953882C80D0859DD3010DBF70A1AB5DEF3CA1A56AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  ScpService.InstallState
- Size 7KB
- SHA256 5261a3beba3836eb9169378f05eb903f92d7bf23cca963c957e7fe1bcfbbd2c7
- MD5 bd6093b64e60fbfc02d1e56684e44f9c
- SHA1 0338d4b8020dcb8be0b1d66b7910bbefb9e20b53
- SHA512 48fac10242a47ddf6df537c26542d9cccb874d50657ce043034a52f234ce28cfa90a2fbe94cad92cacb5188c25b0d8533964680958d1dd20c228974cf3d9dcca
- SSDEEP 96:R3DrP/zatgCnNjn1x62muDr9aHmzcv/65m7JDcm0BefnanGEkn56vT4ZvR++JDr3:NexdYX7OSRjXsaA0Ndci
- TLSH
  T18AF14E54B106CD358EDFB592B4A5FC07EB78136780B480EDB1A05C5BF0662D74B437AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  ScpService.exe
- Size 373KB
- SHA256 151063a5bb61c7d1b9a5efa2c0f91791810d3e5666a20fc09273140dc0bc675d
- MD5 29ddc41dde71fdce4e129fcbf9ad5798
- SHA1 53f6820f0b1593b22979652fab1328ae2e5a95c9
- SHA512 cfa10fb61ee9bfb403e04e14525186ebdf503b7faf5c8f2c31ac16ab1c8460b1421755c68da82d8911caa46184d5180ebe1b4dcda60af5f0b47fb67b57024a71
- SSDEEP 1536:v+GtVXhxJP89k3CupgBlxxmw0cZNjWsbG9znIHDYULhPvCgHGkVjUyVKl0:vHnhGlxsAjWsbG9znIH8ULJCa3W9l
- TLSH
  T16C8451EDF082FAEADCC5B43868D49BE4A5E34C98BA794C63007DBE452573880DB2D517
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  ScpService.log
- Size 1KB
- SHA256 f6ba095707d818718b02b33e62270213dec5ba20b936531e266037fba5f54a59
- MD5 c71a9d50c81f44d520ab2aec0c32800a
- SHA1 e8934ebbb921cba6f6554200b6bed3aab8efae27
- SHA512 9f1acd3662774e113d06651c8f4a1b4bc7ab30ca7955addee7bce2ddcf219c1699de7933794346faa54c8553291a535f2093c9575d0545ae37a75dc3788e9f01
- TLSH
  T11D11D1552EFBF0C9EBA220D0C92139AEDC7F23E6045E7180FDE019D8040A573DEB5120
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral23 behavioral24
- Target
  System/BthWinUsb.cat
- Size 14KB
- SHA256 c565f210729921a51aec4fd6f9f6877469bd872dee234f84c9e548cafdd26989
- MD5 73adcbc9de9012d2f9a70869932929d8
- SHA1 c5c1482da89fb1fbe6d1fa4b914ef1776e38ed01
- SHA512 b501201cf0d0c9211f4d9cfeccc449112cb54874070b106e9a78fe644bc07db3465d4408b0244b8769ea767fc0d619a5959dcaed7e8c0d6ab85312a025406e85
- SSDEEP 192:FeAveEViuLiEOwIIa6fWFOsS61IKhwOgmEwhnFIa/buH0m/AbINk/rkCRJZTI/fU:pYwaPn2KPYSPLjYdV0
- TLSH
  T15F6210A675DE09A1F6D3DC71DAE135ABAC3277C7AC006439226B9331DD80701BA671CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral25 behavioral26
- Target
  System/BthWinUsb.inf
- Size 8KB
- SHA256 f68f142e40d793099ca9cc7f34ed0ed412557ef9719c8123da861288eede3459
- MD5 b77c08afe9ccefda39e55f45aa209a66
- SHA1 aa69bb9a80adb0bc638238636cfb0e9ab926329e
- SHA512 e3c56ee3d9f48f66b9a836c6e495556bda3106d63ddad0e22b47d7e457ae85afcda8f7b52e267b307dfa8dc773327ccd50e9078bac6a7fe443d0b7c5dfde7a76
- SSDEEP 96:/s48N6YaGNs3PvYUMHscodvYUMHsc9gpTX1TYAoxzm3kfdu8b:/s488YaGNs4U6s5KU6s6MtToxpu8b
- TLSH
  T10712F5943D2FB6246D43EB4CBF9628D715AEA120D42661D9BEDF880DFFA070CA10117B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral27 behavioral28
- Target
  System/Ds3WinUsb.cat
- Size 13KB
- SHA256 a6060ef9a0e8352f4d58c729ca4da9c3ac812b2e145a9e4e9dfc631fb20282bf
- MD5 079c4ee76773f86c18688bf68b83046d
- SHA1 208af08fe43a6cfcb3b4fea71e1a17b6b9494b0e
- SHA512 2754af237087e94b04f284a9c96cbffd323e29f25faebdcf97e37d3386e9f3a0d5d1feee05d24a138cf18b175eb275c066c83b500cac755650c2485c14e7148a
- SSDEEP 192:Le3xveEEuLSEOwXMFmIrmu+RTBb6eIpUMhl/lreMIILN6Uh7EsM8II+9iGEfgUvG:Q8wqrn2KPYSPLjYdo6
- TLSH
  T1055264A679DE08A1F6D3DC70DAE175ABAC3277C76C40643D216B93319D80701BB7A18E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral29 behavioral30
- Target
  System/Ds3WinUsb.inf
- Size 2KB
- SHA256 ba6fc0e01d79150ff25de0da787c1bdd0c895055a4b4e897381b7c7393582325
- MD5 89dca1916fa5760e929aaaf54fe235e0
- SHA1 386d8aa6baab68c3dc43e757340bf733035dd73b
- SHA512 ae678ed102ec2f56e7714323c7b02e34b4789865d65985e161add6077f1cb965cc9477385be8e0fa077e89e12dd8ed1545ab6e6d4cca584950560d47ca844d69
- TLSH
  T12151BB88674B2A3579836B2D9F431DE5BAA83580A15C2139FACF4495EFD4B0C13252BF
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops file in Drivers directory

Manipulates Digital Signatures

Drops file in System32 directory

Badlisted process makes network request

Badlisted process makes network request

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32