a051234e64541879b0e946f43a2d109131e83de2656f34fe84b8238ef916bf96

Sharing

Copy URL Twitter E-mail

General

Target
hannah_upload.zip
Size 47.4MB
Sample260729-xd58fsdn4t
SHA256 a051234e64541879b0e946f43a2d109131e83de2656f34fe84b8238ef916bf96
MD5 9811f40540df00251a721859ea512530
SHA1 1beac391636ee38e8d358c881ff30c4206a7141c
SHA512 95ef27bb99299625a62e248a2d1a134dea52867905f400b95ce5ceff46f10493dc82e56ce4d1446c6ac23695cad9f2fdc283663a96ba014b1c0bf40fb542ba36
SSDEEP 786432:GZ6m9VHavHWkUaog3drb88+kL6L4m9VHaNNWkUKogZdbU5uwWZhtML3jzMWD3Sgn:38av+9g3jCab+NgZK38to3XMWD3rrjN
TLSH
T114B72337879C111BDC037FB4EB519803D95952C232B0A19B35D417A6A8736CE1FAF2AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  IMAGES\Hannah Favicon.svg
- Size 2KB
- SHA256 521aa90a776bd2238a2a1376e7e5af0d472afa81a2a46dd18cc2c6721a5c73ec
- MD5 165abe332b1baaf32025a66115436d78
- SHA1 cc316e787f0bc238f4d6dacd030608da871c14df
- SHA512 cd6bcbde8343164537a3402f960b52dc463ef79ec7f9effdc29cee231294dcf36c77761af45a4656af1792eb2022c24e87364f255bfcf87416acd1960c9a8962
- TLSH
  T12F4183B3C39A6BF54CC60B1C417524A932BA2947702EC1AC8BD6AB856D16EFB0170839
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral1 behavioral2
- Target
  IMAGES\Hannah Logo-02.svg
- Size 11KB
- SHA256 c5b7afd5d3d2bfdbf273875273cbe5a913dce25cf6ffa88bd013d312e309cbbe
- MD5 4f7df3b6d6fe1f791dc8433be34e7b0b
- SHA1 c63498f1c5dc33565ffed2dfa5a81d53cf97067e
- SHA512 253acdd7686a098df1ccdf666c70b6c43af9a2e45311ba4ff3ad1b8c42c7d8a5bd70daa56857af02ac75573d986a5e890a219297e7e72fe9bd1c73c7e61aac25
- SSDEEP 192:/iysa5Hk1rXS28Z5FUbOeawkdqRVHQ+C7vSRbRA0HRhE+lKn:/VsZAXO9kAR5Q+U6RbRhE+An
- TLSH
  T16332617713555BBB66C18B4444E5606A37F6C8A772FAD1ECCB6BEA929C019F300B4C31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  IMAGES\Logos-01.svg
- Size 161KB
- SHA256 b53bda7dfd882f112c94f95cdc72c3dab0aa84b5da385295b3ef2ddb3dd36807
- MD5 8cf02f0e0bfcaa1665373eb179d2c8e1
- SHA1 cb04cb14a9d53be24bd34234fe4cc5c8ffdbd73d
- SHA512 4a21bcca1eb5e5c81f4a79b1fa0f93a5f93ac636e2e923f0911b2170cb7fdec0953f6bd315b5f3e82f1a64b1e7e296bbd5a0be5132fb957d8b9879312730a9c3
- SSDEEP 3072:m4uxDg/iG83XTc+u+ZuNLSvkV+AjRZhrUtVECe/VzbLYkvAlC:m48g/iG83DLZ3kVxNZhgtmCubsC
- TLSH
  T131F313732DEB3568BDD5E3DD31BB061CA4694B840077E887AE8834FDE80271263A5CB5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  IMAGES\Logos-02.svg
- Size 6KB
- SHA256 1157df4f68cd643bf978598e6dd75a17b4235095dcce613ce0972596b7387984
- MD5 7afcc412d1902818ac58b1fe2458d5f7
- SHA1 3fd520f745920b1db2f4d4f84a10e287d9e5ebc0
- SHA512 ecfde789b770fc0c4a13323bd4d7ea2c2e4b6b70e6cab278dde28c529b9892b5187278e3470d8d7dbb86dcaca4bf2f4a28a4461e751c51924656f1d6575344dc
- SSDEEP 192:P+905vc0W3llAlK3TLLw99dPn6YTjocrU:YNVek+j6wj1o
- TLSH
  T10DD164375358ABBCB6824F04C965107636A594C6B1B9D2ECDF778706AC097F340B4DB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  IMAGES\Logos-03.svg
- Size 329B
- SHA256 3aa889716c84fe28075054852c6e3fc8cb9fb1418c8604dd9905bf50f3378afc
- MD5 a93f868a53d2f09ae46c271fb0c00479
- SHA1 40d2e8a7b9e5bfdca36137ed7bf908e5b803269f
- SHA512 76b95f57a6267339cdc69fbf59b576bbff0eeb8ff31d8a8bc5d7d7b17338079ca1303ed829820d2c103db70c06f345a79bdd688abe95f74b2f3153d8c58f780c
- TLSH
  T1A3E026A9C8AAA804C02A473FF0F49C86D21FAC0A938A4E89F1C435BA90740663959159
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  IMAGES\Logos-04.svg
- Size 3KB
- SHA256 06bd300a070910a5e3658cd1720a8e6d1acdc6b515149b86e9eedee3a9de904d
- MD5 be6fc2144fe78a91829a855970791f15
- SHA1 80e55f55398f48d30b26718d55778096f59c2c59
- SHA512 576fe75fea985df3d2bab650c6fb28423439b22007217838aa5d64d438059d92b1d2d600bad1a84605e1b209f164f16fafe89905fe8ea00ceebc52018c94f18a
- TLSH
  T1DE71ECA7135527BCAE424F544160607336DD5417B978F3ECEBA3E25574065F288F4D38
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  IMAGES\Logos-05.svg
- Size 12KB
- SHA256 6eda5a9c44f31ad47611ef489f0d4ad6ef514152c7cd0604d57bd2a512eb51fe
- MD5 d7c99cac55ec5fe969fe27bb6f0784b6
- SHA1 9f69b3b3a62d16720007d12efc3bd7241cbaa428
- SHA512 82231564f86739d06484bfd147432f0ea3fba7aa79aa81fc994852794f6d667a7bf8d52f6d4a2adf455f5ef5d42999bcd1cedd2fdb8fcfd6e400f23e310d3d9f
- SSDEEP 192:SW5/MtZbOU9zR1nIxHHu7jBtUuJFDzL7s8m3qEXnn1Z6loDZ8gz9IGZeNJEUdReF:SWir9zR1n/7mr6lRO9ITKU+7rG/R3R8
- TLSH
  T10B42747703589BF9A2D71754CAAA54933AD4D4D3F279E1ECCBA3AA169801EF34070C35
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  IMAGES\Logos.svg
- Size 190KB
- SHA256 0f16f624b5cf2b4b83b974bde6dc046d1e3387652f178a2d8bee2bc3f1bc940f
- MD5 bc12ef6142726ee0b378bd96b9ab9bda
- SHA1 92fc7cd3621b75216541167f3173a183b72ae905
- SHA512 232af5528527231c091aa80c917ca72be120bb678112d16e00dd2b305db3d496f2451cccfcdc3821877a1465909dc3c46f2a4315b18e34ac33c702186830f17c
- SSDEEP 3072:14uxDg/iG83XTc+u+ZuNLSvkV+AjRZhrUtVECe/VzbLYkvAls:148g/iG83DLZ3kVxNZhgtmCubss
- TLSH
  T11214F1731B2827BC65C24B44D6E60459399CE6C3F176E0DDEF6666EA9C10EF290B8C30
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  IMAGES\Young & Branded logo-01.svg
- Size 8KB
- SHA256 a5b828931eb4c94c9d6c636dc017d4dede3ddc670c71951c4336b3d1089a7548
- MD5 60fc5a3a9c10ef527d9c998f8857d441
- SHA1 6303b970ec85947552a298e78c2b314568601d3d
- SHA512 7fa4177e67813afee35b985630b44ed167f714776055912a3674d3c4f4cc47a5659b0d99497c681c09ba8cbfb1af98cbcff953ef2ee76f530b1edac494e10250
- SSDEEP 96:s2sZh+UEeY4XjRI2c5emOB5hGB45TIbhYO+BwqE92M9dDKcZ+0awPP4Fe8ieRNdV:DcXSx5e/fGBMTYqM99sv+PAk/e/
- TLSH
  T1600295B6932E7EB5F221C3E8C51420ABB579989FF06992FCC7E2F10679357E2416C810
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  app\Http\Controllers\Admin\SettingController.php
- Size 2KB
- SHA256 1c0a54650cee36cece5746e782bb93939f87347eb3736b6fa91cd1d39832293a
- MD5 a9bfff9f443af609e4f1f3c317886461
- SHA1 2faf3a484d801e67a8747c61f203a3f5b8f86c7a
- SHA512 2e106f6aa504a966c03f5f6f7ffa41c2bec7ccd7164438ff016a87e9c5b569600be3fffe49886c34e57f98e61182ef267a6b0ca8a9e7a3dade57503c3a6cf0b4
- TLSH
  T1FE41CE5618D23629D453A0F8B78EDB1DA05241039064CF32FEED2B948FC47AD89F4FA8
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral19 behavioral20
- Target
  artisan
- Size 425B
- SHA256 f91a517c0c5d3a904c3f390933964a5e08ec1fc68146882730daac4aca4ffcec
- MD5 e66bb13691f6184c762c196427d8e685
- SHA1 b8f0fc8820d5de0b4de5710b0184fa998e156089
- SHA512 fa3f43c9125e19995c2e8b17663396fdc20ca4007e1bda34cff35738d65b3b88ae1e31de1118ef116f00a8b2f2f25b940192f98a11f67d63f756b1659becc1de
- TLSH
  T137E0A3FB078C02A1DF9634DE164CD4031C5DC9177CC010A5F415395887C58DA77573E5
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21 behavioral22 behavioral23 behavioral24
- Target
  composer.phar
- Size 3.4MB
- SHA256 345b9c6a98da5c30dcbd4b0d99fc8710bf0ae98a3898eea18f7b2ad9dec93f06
- MD5 c68b3a13ad9c5b1a83c4a9b90ad5b82e
- SHA1 c490c89a9465ee51b4a6f7b99d07ee6057940879
- SHA512 dd0dfec9b304edd2a8ef28a30b835cb0e36f3bf5960d0058b46270fbf5c40506bdca8c623f08a1cfe0f6dcccfce4ec971bffd719b3a71fb916cb1703cd0821f9
- SSDEEP 49152:TW5rN3U9SbVYY4vpfHAytRvXAIpSM+ezIm:kE
- TLSH
  T1B4F53A46E0C95E62986371F9D38BC509CDAEB025D1F900A3FBEC62086BD517C4673ABD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26 behavioral27 behavioral28
- Target
  postcss.config.js
- Size 93B
- SHA256 c713dcb623f3a959b28f6e7f724440660f890288c7b796d8c9ce42372ee7f36b
- MD5 40617f13f9f0033c23f7830f6344cfd8
- SHA1 c3eb3a797e3ef76dd498edd08b37c98b2ba4980d
- SHA512 d4d3a17503e3fcc432277caf738b2c5b9400d9ab46ab77628546c951c2ec39c10731e9dc11f0d45e600689806d616194224f6b89f7d87d6744329ea6a5407cec
- TLSH
  T1BFB01202007C6253509000021794401250D94AB72C093881760C05145F0D11E5035340
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  public\build\assets\app-pO_CareU.js
- Size 88KB
- SHA256 f275aa198b020222558ff4e545744dfcc214b21c8964788d91e600e9527ed38e
- MD5 9c403263931b431dc53ba5f4f211f2b5
- SHA1 7114ade08399bd743b693b32d9f24475ad3536ad
- SHA512 26d34ef4329006459874605299e244798ddd17a48b6bb44941e41f8a144f6a835502cbb5228691539ff0a43e1fb557ae540ed92f14c42a35478f5d66a648fb19
- SSDEEP 1536:nNElP35oG4cAPC/kL9TusP8lvIL3MO0IzTM74rJzS:qlOG4CkxTusEaLcO5w748
- TLSH
  T152932AE573D6B07243EE61B250BB4205F3396845684E1028F264E8DF387688D96FBF79
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32