a1da8ae2b4676029ec37247c7a3e8e2d4bead005e4e2a9320d6bb5881789d65c

Sharing

Copy URL Twitter E-mail

General

Target
WinNTSetup.exe
Size 2.0MB
Sample260729-paa9xavybw
SHA256 a1da8ae2b4676029ec37247c7a3e8e2d4bead005e4e2a9320d6bb5881789d65c
MD5 cda0f81ef6c18b2fa47f7d2f51193da0
SHA1 588f93acebc375bc36fff1155c55cc40a3ffa800
SHA512 8b19703f0c1e0316755642737752076573db95c69ba1f22475106e49aae87b2df9c69ee931c528eda6e3224c8640ebca70b96646646f0ac60e5a6c8017950927
SSDEEP 49152:cg3B8uk7Gq/I9M4rV/pxVrnCnW/JTE6w0:cgWuQL/2M4rNpxAnATE6D
TLSH
T1E7A53372EF01E263C0B39A3648F572D9566722772143E50EF3F56AB83497686084ED8F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  WinNTSetup.exe
- Size 2.0MB
- SHA256 a1da8ae2b4676029ec37247c7a3e8e2d4bead005e4e2a9320d6bb5881789d65c
- MD5 cda0f81ef6c18b2fa47f7d2f51193da0
- SHA1 588f93acebc375bc36fff1155c55cc40a3ffa800
- SHA512 8b19703f0c1e0316755642737752076573db95c69ba1f22475106e49aae87b2df9c69ee931c528eda6e3224c8640ebca70b96646646f0ac60e5a6c8017950927
- SSDEEP 49152:cg3B8uk7Gq/I9M4rV/pxVrnCnW/JTE6w0:cgWuQL/2M4rNpxAnATE6D
- TLSH
  T1E7A53372EF01E263C0B39A3648F572D9566722772143E50EF3F56AB83497686084ED8F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery upx
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7
- MD5 0063d48afe5a0cdc02833145667b6641
- SHA1 e7eb614805d183ecb1127c62decb1a6be1b4f7a8
- SHA512 71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0
- SSDEEP 192:qPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4U:F7VpNo8gmOyRsVc4
- TLSH
  T1CB326D5503504AF3E996863C00263BBFAF796A2095F14D53CFA394C0FE2E5C9AD78352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $TEMP/WinNTSetup/Diskpart/UEFI.txt
- Size 1KB
- SHA256 7528de99315f8a092d5fbe2f994b0386be6180e830050834092108cd66d1b122
- MD5 0878e4b7937bebda3e7efd8c9c34e216
- SHA1 4f47b3f2af35ab2ad610e49baef88329626080ad
- SHA512 cf2d7b3daee7cbb360ab797eeae2a977a5bac9712bc696bd229c5cf47d2bba5285648cb6451874f7def77b509c1db1ce96b078c1a513396297e753bff006d1ed
- TLSH
  T13131BE16A2D21636CD63851311BD7074BAB034508AE2905CF86FC2DEF326F78C26EB68
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5 behavioral6
- Target
  $TEMP/WinNTSetup/Tools/imdisk/cpl/amd64/imdisk.cpl
- Size 113KB
- SHA256 eb5b467f230bb85a74620a52f139cc35772e89ea9b8ffa2a64e10f878aa7b417
- MD5 a19a0f76956805a157281a3998f06a29
- SHA1 eb2e8fece8f2ffd2ef605a000fdbfe46bc97067a
- SHA512 5f4a013e28fdb2b67883144772afd717813d96f84d9eb680ad016fd78d0d8cc8061b5dd78d07238fd648c62dd1b09a8a0a752575a826bc1c96cdded84635f9db
- SSDEEP 3072:yQzTkHAMuaNaGnkuXOfJX928aTCbIrNZgN8IKm7kZtt9Ettt:4AR/GnkoyJX88YKIr/grKkkZtt9Ettt
- TLSH
  T18EB3C602E3E54298E5B6AA705AF50235AAB1BC446F35D7CF0150BD0E3E71EC18C7A76B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  $TEMP/WinNTSetup/Tools/imdisk/sys/amd64/imdisk.sys
- Size 47KB
- SHA256 6702202220268787e361f5a82dae53362c8e6c6dcd240bb01b44dd77ae0788da
- MD5 85e0e6a2e0ff7c2ea46a0ebc9af0e628
- SHA1 66fac892b0c1f5104c3e5da09cfba64236e3b017
- SHA512 1f3644cc0f00c62005a26cc5d2e6bc5d21806770f9dd43933cc5e77a4b32c39f3ee88d15ca588155e82d2c3ae3f0d274e5890c13d9a2a32be992d90026d6be8c
- SSDEEP 768:CuWLlETh9IlP49QX6C431Z7XLDIwsGT82Lq9KPikQ:xaEtm9X6vfXsP2L0eikQ
- TLSH
  T1B5236C83E1A941CDD9AAC1B6C7E946B7EB31B80467751ACF489087256F12FE0EB3C315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  $TEMP/WinNTSetup/Tools/nativevhdboot_x64.dll
- Size 1KB
- SHA256 9e533d246c17994339660a273d3ebcf7db532f440c089cd4f8e103a4d2ac74d9
- MD5 893c137479848a119677a251c390c63b
- SHA1 a72017ba34c83c76fa039c1a354182fe946fd6a5
- SHA512 e6638220ad7413b447d47fc6b571f63bb0feebff9bf37bb204750b191e3988f549c9ef2b8c7c11eb248067f00e42cf9ef1145599ae2443f25cd26a40366ddcb3
- TLSH
  T18E31C22120D5C1EAD15CE574067B2C14B592752047B2FB493A5844B72A32AF8CF6AB1D
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  $TEMP/WinNTSetup/Tools/nativevhdboot_x86.dll
- Size 1KB
- SHA256 7319eaa311a8a808f0af09be14ef24182c3fe4ea80e5f84145f4a3829b37d98b
- MD5 2090bd824412787b0dfdaf045857941a
- SHA1 95b066d61531d1f6f4404fdb56d5a70303fc8099
- SHA512 078684c645b9818c28be6ce15bcb00d3454b01c7995faa1532eef4c247425e66ba43bd79b4df850364c6ccb04146937032af1a3e92bd1f43ce447eb89ec05076
- TLSH
  T17B318B4EEAE041BEC819217806A38BAA3FB03E0116D0D63736397F3A2DAD1B51D61312
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $TEMP/WinNTSetup/Tools/x64/BootICE/BOOTICEx64.exe
- Size 489KB
- SHA256 e1cb831ac9213b52066f934ba0fa80ea8a9de48932452d4142fa085a2ba24fc2
- MD5 7ddd108c095016b0e2e8d6b5b04f93b8
- SHA1 3764d75c02c8ce8d2c78203aa9eb7f8018a112e1
- SHA512 36c77eaafed04eb3a337a909a90d4c3eb66e1d36531c6248095906332ea6d03dffc9abd7fbcb3c2101065110e4536c0a89b6320dcab386871b3f9d9e34e40bad
- SSDEEP 6144:4v/DcaTr3TNUkgs01v610dZlfLw8Not8jfCHGSLs/u3fvItKDm1bVcYGz9qA/8qI:k/DfGVBcXfHGSQ6nwUm1q5z9l8M
- TLSH
  T138B401217E4D96A4C10804744C96DE242272AC22F81A7B1B63DFF74FF97A331DC2D699
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

upx
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral15 behavioral16
- Target
  $TEMP/WinNTSetup/Tools/x64/MSSTMake.exe
- Size 114KB
- SHA256 360fdca4daeb6ada1f76b8940af9d509624ace6db03d1a735b2e393c6d2b4cf1
- MD5 64d41e1e1a0410bf669c1d0820ed4c1f
- SHA1 c5e9017f725df051a620d6e565b14e994549f6c6
- SHA512 4c5dfcd8b42f095749d00bfbec2c7c84f9bbaa6a8cb13891d1c7ccb70cfbffa418eb849e64f0c85129eac55a467af39b07d2381cdb98678dcc1dc0e580305500
- SSDEEP 3072:swvKErKi7TeSS2wpdhBMo/VRCMIB9dWIA5TO7Agyh:sWrKITRStDhqcVPIxWIA0A/
- TLSH
  T176B33916A7A560F9D863C570CDB3A623B73038699378A3EF47546E260F323909D3D369
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  $TEMP/WinNTSetup/Tools/x64/WIMHost.exe
- Size 88KB
- SHA256 7320b23d0143f2727074f413c3bff7f78ad43f8b5f8593fae3b1373ad17bbf09
- MD5 abb6ef6b02381d752191258a1fa08d81
- SHA1 65c2794551c0b478649bbc1ecedfb489292153ae
- SHA512 1eef297b078a1b039b53aaa236cb638ff7dc20f7b90650d4be5e72a248a40cee43c9bc84e12b0b8c7ea1946c3b4c474739178ccc14fcc0639394d4355247b4c2
- SSDEEP 1536:IjyiyB9p853bTbogk74LOIN8zl82fC4jpJKv:IjDSp2nboN4iy858gHKv
- TLSH
  T1FE93F742A2A6B0BCD52AC17553666471BA71F4855B327EEF4360C7301FA6EC07E38F29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  $TEMP/WinNTSetup/Tools/x64/bcdboot.exe
- Size 257KB
- SHA256 b43d9410f3498c72f856682ed7777f39b07c3adb7fd67456cde1547152588f5e
- MD5 457d8179e115612fe8ad6882107f9242
- SHA1 34329de913548ae8fb467ccb58c3b9dc85dee9a6
- SHA512 b974deceaf6ca17bdf20fb71a5ed9ccb31ff90038eedb23f3fd46d1bf7796d80a6d9ce96f09064754b5e39c2aa392a591ba4d720e32767400910cf407e87ed35
- SSDEEP 3072:PCFwaZUj8M6J7Qxq/lnW0mWucAgJ6Hqxk7wEzl4necD8dJL9tKtvLFJ/a:6FrZ+8M69WgvcEk7wEzlwSyJJC
- TLSH
  T1F744A30A23FA1954E5F3AA34AAB24512997378B16B31C6DF2294C07D5B33B94FD34F12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  $TEMP/WinNTSetup/Tools/x64/bcdedit.exe
- Size 489KB
- SHA256 980c866172718308ef44b649d48d11c19eb4543961a1f346b6b15454f988392e
- MD5 7d6f11e4ee7448dfef7daa102d6f01dc
- SHA1 a4d819823a29184e415fad2e4be145b77507081a
- SHA512 3efc750ae5e226030852a6028156d130b098862db9b42cbffefbf2ce3c818d53c45d3e0d6f49b594d68c6f6c988f32ee4292fd28d141ef2e0bd9a330f977a386
- SSDEEP 6144:MAK5t5ONNhcyq+NlgkEQM0oX0j23rldce:MjrIWL9FJrD
- TLSH
  T1A9B4410663F91244F1F77B749AB585608A3BBC916A39C69F129D402E0FE3E809D74B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  $TEMP/WinNTSetup/Tools/x64/bootsect.exe
- Size 105KB
- SHA256 5de135f2b6f76f76aaf5e3659dc19e5002f97e7a2e95d2e9fb5853322cb862d4
- MD5 2bf832780fdf5782048d54de966b5557
- SHA1 0d7332d5242f8d2b5af9f1be1f95f8b1375d3850
- SHA512 8d612947b4232d21f40660e2f906ea178936f311d69bae66b2ede74c8f018c30017b94ff90c9ba376d900d37fae34547ccb8e3b3f35c7ef2f05a634085bcddfe
- SSDEEP 1536:wjzmAqtyFjEIPOhHK6iSlr+dBT5kIc3Ju2TQyvzAf:4qAqtyFjEkAqclrwbF6TTQyvi
- TLSH
  T17DB3E70B52F91184E1B67A34A9B505219E7778A26B34C7FF11D8A47D0FA3BC0AE34B53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  $TEMP/WinNTSetup/Tools/x64/offreg.dll
- Size 117KB
- SHA256 6ff59490887dfa4ad0589a64adc539ee87366be2e85705397b83487e5d0bbd9f
- MD5 c01eaffb542126a5a702cadc03d5c8e9
- SHA1 1607d40e49d04e243ce79b2aaf7f2fe8bcdf288c
- SHA512 7f65f208a1ec9ba4020d1d68b9586fc79f478b98675030f644c3a9beb67881991e8cee723d458b5011e83d68186f7f32b03ff1e4d97c35145b56a1a003678974
- SSDEEP 1536:O2ctxyL6tEFjp7uSO/39Zn2izA9qLUEsIg26QnFMoa58zi:O2wx66I97uSu9Z2is8Y2TXe8O
- TLSH
  T14EC39E1E73B821B6E4668278C459430BE776B16623249BDF02E0CA7D5F13BD6AE3C741
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  $TEMP/WinNTSetup/Tools/x64/wimgapi.dll
- Size 797KB
- SHA256 14e85f541b282c59b796ba01ddcf8304f1c94835d2975b3da69cc450afd9d1e8
- MD5 fa5b941be590899a59c59dc883ed050f
- SHA1 91a9517d09c298eac0a3e6559be90cd4881fd9ed
- SHA512 09df8788213b2e44995538e295e44aedd49d5c238aee62ac0ac1e2fd1d2705af9754ba4dac2f376a0e6581155f6d0c84f0b5f4b58602b0d658a0ee291ba4b5b1
- SSDEEP 24576:67kFs8W76KtdHj82kfuEFl4RaujHPvUDm/Ef:uos8W76KtdHjhk2EFuVvvUEEf
- TLSH
  T12A055B1E73F800A9E5BBD674CA758262DAB1B431372096CF2190C67D9F27BE19938F11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  $TEMP/WinNTSetup/Tools/x64/wimlib.dll
- Size 481KB
- SHA256 dd19c49b8143b8b3910c5ef1d430dcae8bab2197094fff5b96bd5844aa5046c4
- MD5 834db85f8cadc30f8de15a3676f9faa3
- SHA1 67d59e47bb56ec69a391d39dcfbfba2bec2ae1a5
- SHA512 9989aae6223c8dc52a1eb5296bcccfea1de2ab59a90ab8cfa1492d8e6e18368b9a3a09e8267a3ee4f4d54e26ac537bea47722cca7314fbb5e137edcae4cf2666
- SSDEEP 6144:5Z2P2tYqmBaY6u0AMcusIrxmIlbQCDBXyVtDSPKbMsjsss:5ZXtVPAMcl2PbBXOq1
- TLSH
  T119A44B06E3F6516CF2F7E6305A7A5672A9337C155530EE6E1248C67D2F33E40CA28B26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  $TEMP/WinNTSetup/Tools/x64/wimlib/libwim-15.dll
- Size 467KB
- SHA256 c5063ece28382bf6a45082e6a77d300aef70ec301bf7591f142056271438b7fb
- MD5 2b5c58bca681b69d3ba255dd6857795a
- SHA1 d71461bb4bd154cd416a50ed099f539fed1931cd
- SHA512 2630f12f5e9e11670b6eafc8ce638580315ae0d60565dc969e9f02a37d3a7128dc17f45b0405c4210eced5fa879fabf144586f30b5183134ebc5bafce9c45f8c
- SSDEEP 6144:mb9c3MGAnoUQNgPa46I8aIWV9vLuIZRuvWLTbk0:mb9cxSggy4L8a19vLMvW
- TLSH
  T1A9A44B03E6E6506CF1F7EA305A766122AE337C415A34DD9F1358F6792B73E809A34B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29
- Target
  $TEMP/WinNTSetup/WinNTSetup_x64.exe
- Size 1.0MB
- SHA256 5236a34ab904d14ec4b0d37b89f584756f16caf70f1b6296e1020ba8f6b0de4b
- MD5 ac12027e637978a927c436909a508226
- SHA1 84c961a99b4dcc71477746a347721261a27d4f13
- SHA512 87c083273349b99a3d0bcd8f51892a4161f3980f369cd9502808c9353b9f353ae69978866170b5c1b573c12ff9d6e0bd78f47444a48128c0d01a45203e84ffb5
- SSDEEP 24576:vnswxOPG3vs4hfOlCH2Tp1WkRbRNOGLF:vsR+fVhfOlC0p1Wk11L
- TLSH
  T1C9356B0BB2E9015CE07AD2B5572A5122FAF3BC446E31FE9F42605A151FB2F50A73D70A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

UPX packed file

Executes a VBScript file via the Windows Script Host.

Enumerates connected drives

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31