faea2121cbab7dc6d4793515ca12ed161d4f3b3d4cad4ab0d451af7e6f6a78fd

Sharing

Copy URL Twitter E-mail

General

Target
WIS2_Studio.zip
Size 24.0MB
Sample260730-am65sahc46
SHA256 faea2121cbab7dc6d4793515ca12ed161d4f3b3d4cad4ab0d451af7e6f6a78fd
MD5 259ee6862f442a75263e968a81c20edd
SHA1 b90d7cfabe111f0223611f49f4a101fb1bf8c410
SHA512 f98b6c7898ad70da1cfd25a497a3b7dc5c98cebd9c24bb2820e819cfc2ab419f9d4b2df0547117df23f8debd894f6b1eec3e084e742d292be953f4bfdb326198
SSDEEP 393216:4L19B6chY+8Zfuin8gin9IM5ey7SNGmzpr+/TcR60PL+qHsutsrso9SWr1IBGUls:4L6JuMqrj7QGMpQI00j1vtCHzr1+xn2B
TLSH
T14047330F52B3F576B049753215EEF6083BA48DFFCA5F665CAFA00064637A062AC9D127
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion execution

Malware Config

Targets

- Target
  WI2_Studio/WIS2_Decoder.bmx
- Size 82KB
- SHA256 31225e237199a14e0d0588c9e35a43df35d87ec43cbf266f7fad32abc6965614
- MD5 7d5746e6395774426d7ed5d8723466f0
- SHA1 c756faa7f73782c43d5965781705bee9f00bff3b
- SHA512 9ed85999c5162e60ab42664d00ac842d7c67d00c524e7e9f62d911d28d4cf8895c81d2ab7b8de8a2712d971d15d448e72b63a825abcc8add77a37a46fa0aba03
- SSDEEP 1536:XFxEW5PpfFA+I22x6xyJSL2CxB7+wlk/f+q909N1y1bR0gYY7F26K:DmJSL2CxB7+woQN1y1bR0gYg26K
- TLSH
  T12B83F98D269F3421A20D164AF14F9649F827D03F480EBA4A7E1DC2748B990DA5FF1F76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  WI2_Studio/WIS2_Decoder.exe
- Size 5.0MB
- SHA256 1e7eab4c16b80dd9a8fc76d4aa77faeb43edf7d8fcbf015256e6d8a50f8c23cd
- MD5 3775d3f06f422c2dc611249b3088218d
- SHA1 0693572c2cab2ce6e9c48f28baba60edb7a9ba54
- SHA512 317122ca8f963e7f1ecbccb2f538909d8ea6305336dcbab06ff2c8b132fb393c832e37903743108ab2385eb53770abd2464b233d0f8293869dbf557f13b9bd35
- SSDEEP 49152:gPXw0aq8G2zaXLdG+F9AHVBs+NST9jN1YkowYMvQbExAkSvrjqVvtYin2ydGetO6:g9Czhe9gNEkJyVVYiyenqSSoDcJb3
- TLSH
  T1C2366D5BE6A354ECCA7BC1348267A731E531B4341130BF6F1A60DB716E32E909F5EA24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  WI2_Studio/WIS2_Encoder.bmx
- Size 71KB
- SHA256 7bafc4fc06a9e97269552c9ff3ce9ff8542f1890c145d8ee6d42b1277d29621d
- MD5 01a704d74d4846b97bad94779b121800
- SHA1 9761df704d10e1729f657fbd7e3ada4384b38a48
- SHA512 851dffdbab0652d808ab95c47a8b686a72864450216ec5e23090f5a442c5a28cea229506b409b6a2cdbd0ea3501c4a6a4f5f6348ecb1d23fd9525c08bf542d8e
- SSDEEP 1536:2S4U8cTbXLWk9gNGf7cZ3Xk55tCferKM80:ATNZ3Xk55tC2rj80
- TLSH
  T14563C78D769F3224920A160BE08B974AB467D03F5C0F798E7A2CC2504B990DE5BF1F76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5 behavioral6
- Target
  WI2_Studio/WIS2_Encoder.exe
- Size 5.0MB
- SHA256 28e713aa68da3a85095039f42fb8d3dd81ab6dd91661c673e1a4ff52c2b7e8a7
- MD5 11e1ad48b9eecfe7c54fa87a6e76ec26
- SHA1 45f779fb8930179e6ace995401ad2ba6ef32bae1
- SHA512 73369df61ab4f50fbf34027a251134d65e9a9cf5055c35c5f8ce0eb5e4bd5528870ad0e35fae6ad16a1b64574b81bb1706c72d2c7281eb6d698ae1bc0a0067ea
- SSDEEP 49152:iY4JqIQ9PGhWFiGLGBsYc4N3WIXfN1YkowYRy/jWsksOhc3y9r3ebDLKW6VTODvn:/RIhmiE4N7aNiDGW61k309F8DcMX9LD
- TLSH
  T1A1366C5BE2A354ECCA7BC1348267A731E570B4341130BE7F1AB0DB716E26D909F5AA34
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  WI2_Studio/WIS2_GUI.bmx
- Size 76KB
- SHA256 73fabd5a7de2a64c34a97efb7c06e639e18ab8603547157806673edcf441c653
- MD5 59a14325f10e84eb665b7f35d73f5f4b
- SHA1 e0a63980466e963609b6f49194a6240a2a707062
- SHA512 da1b2fbac2f6be2187c5a6b914ff440c95fac83e50c5c8537946ff2172c0d7110dc8ce07b49f2cb71a7aa892c55df5e2d7421cbb6fc062ae49d8fe4fcc5a896b
- SSDEEP 1536:USbRyJyj/OngiLsD/9tbxg31jFa687/mUfuLCUjygL7kUHlzcSCZxkAR:1VyJy7mi9g31j4UjygL7kUHNs3x
- TLSH
  T1BA73097AB40A3168D6479DACA58E4C8EEE6D31BF821E145DFA4C4AC44F441FA81F1BF1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral10 behavioral9
- Target
  WI2_Studio/WIS2_GUI.exe
- Size 5.4MB
- SHA256 5485b9a85ef40599213b82d2e94e5ad5f864088e1d2b073ebedb96d3a489391f
- MD5 66aa6e739bb11949e2852dfa4dd02a37
- SHA1 9272728eb69c5b6adee0e2b50e44694a77775227
- SHA512 bc68efbd83b5043a946bce5fb69c51817076a79c876a2531e1a8df863e43fd35b0f27a22adc6d52189c3939b26cdae640ede9b02819a475012822cca1ecb54d4
- SSDEEP 98304:8E2L+CN38kc7HozdaoejMM8DcvwESvpR:q7N38kc7Ivp
- TLSH
  T122465D1FE7A374ECCA6BC13482279371ED61B8381122FE6F1564D7316E21E909F5AA34
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion
behavioral11 behavioral12
- Target
  WI2_Studio/WIS2_Selector_Decoder.bmx
- Size 9KB
- SHA256 9b9638819e62e459c67c784dea13b068f848f9cfdca6541431109af3a03c725c
- MD5 ff1d0e6c93a41bfef0aa16608dbb2199
- SHA1 dfd6dae53d4aad3dbd68e5730183ada89701ee67
- SHA512 4081a9e32b6c2000b6d0e8d7d79e9861659c2ac023a5819ed39fa864c4b0d94fc591517eeee3cf21c2b83608bb8b285cc977c41527eaf699fd006f7eed56a4a7
- SSDEEP 192:9XPqHAr++V7AklP582WjcdzPFszF60lTf9OMXqqVll6FNgATKYkdS1K/DhRD5:9/qgr+oAklP582WjcdzPCz/d9OMXqqVx
- TLSH
  T13812427D2DBF3825124D281DEC9E1E86FCBB59FB4A1B5284611CD124888C09FD3F6A72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral13 behavioral14
- Target
  WI2_Studio/WIS2_Selector_Decoder.exe
- Size 941KB
- SHA256 8e9effa1e83abe595683a98629bf5301b01e0af9073c34984ad035af1c472278
- MD5 0b039267fb11c846da520607e1f1f46b
- SHA1 3e7c515b2619796caff77b3693f6bc3c505cf1b3
- SHA512 3d4e3285454cbc4afc94666bbd3f0bf2ca09214fbe28cee9ab5fe86e84029344b59a4954290ec87c6009a3779c1afc62cc02aca167590f43a73742947baffd35
- SSDEEP 24576:0xIIsqCtxMELLcNVHB3c9aOnXkIB7XDe:0xIHqCtxMBNT30XkIpTe
- TLSH
  T1C9258E4FE2A360ECCA6BC13486679772B971782112207D7F26D4E7312D22DA05F6EB74
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  WI2_Studio/WIS2_Selector_Encoder.bmx
- Size 16KB
- SHA256 664bc27dccff468ce1e6325399424fdec4ca126d1321224f90aca642f3188869
- MD5 c1e986027e4195663b526718844c50af
- SHA1 9d3360022e9f9e69deaa1a9ecb79fe429625a65d
- SHA512 666418c12daf243669d0cc247cd10d1856297f2073a44fedcec90db275c560edd47657e3b8bd11c960c308d0e4e202a18c2054658ed42d81df9b6c0527072b6b
- SSDEEP 384:IhRZqgCLmT+liIzXQBKwKfVlP582WjcCzB18D4cC1sD06qCe7DC6PbRlrH/P1E9r:IhOA0VZnxXDeCxs7/+1j
- TLSH
  T16172627C2DBF3849615D241CDC5E0E96F8BF19FB4E1B92441628D61688CD08FC6E6EB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral17 behavioral18
- Target
  WI2_Studio/WIS2_Selector_Encoder.exe
- Size 1.1MB
- SHA256 b261c5b0f8134f92fe96c8f2dab92e3bf159787d07f666f153e56e940553601d
- MD5 86a3cbe8ccee33bdacbf9ff7519bdc48
- SHA1 f0e82a618164e58d951a23d1390674e51370206d
- SHA512 b5ce14cd25c6900803c212fe46bcaaaa3927169b693412f75a38ccfa2e7f238c8ff5bc9e93646d1ec427819599b4147b62414f2001afd1430e71ab6c77ad0717
- SSDEEP 24576:oWxrEVgZV1QKEk5HfRNXK+WSWuhC2q0411:oWtE6aKEGRNRWahU0e
- TLSH
  T1C8458E4BE2A351ECC62BC174826B97B2F971B42411207E7E1754EB313E23E905F5EE68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  WI2_Studio/WIS2_Studio.exe
- Size 5.4MB
- SHA256 5485b9a85ef40599213b82d2e94e5ad5f864088e1d2b073ebedb96d3a489391f
- MD5 66aa6e739bb11949e2852dfa4dd02a37
- SHA1 9272728eb69c5b6adee0e2b50e44694a77775227
- SHA512 bc68efbd83b5043a946bce5fb69c51817076a79c876a2531e1a8df863e43fd35b0f27a22adc6d52189c3939b26cdae640ede9b02819a475012822cca1ecb54d4
- SSDEEP 98304:8E2L+CN38kc7HozdaoejMM8DcvwESvpR:q7N38kc7Ivp
- TLSH
  T122465D1FE7A374ECCA6BC13482279371ED61B8381122FE6F1564D7316E21E909F5AA34
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion
behavioral21 behavioral22
- Target
  WI2_Studio/avifdec.exe
- Size 11.7MB
- SHA256 a03664ddffb9d847eb484af6ceeffce96e03d641da5c577d26662487dee689f2
- MD5 56979f448f28705290db627d02eeebbd
- SHA1 ec8fb5122a3b8020213348a033ae10781676f5a7
- SHA512 2ce52e7f0445ea5b9741e1e43c3baf8d2b3141fb932335e1c9fa0bbd9b7bd616053cf48fd2ae72587b7b8753677020cdeb3fec50746da76f6192075c2c40386f
- SSDEEP 196608:apP2naRL9CybWjAiVnofH2gmXjrRGhEP6Au1sysRkTiXN+LuKlzwKiRFWTa994uJ:k2naRqZofH2gmXjrRGhEP6Au1syKkTix
- TLSH
  T10DC69E49E3A341E5C126897489BB9611A724742E87E343FB36E895B53E72BD03F39F40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  WI2_Studio/avifenc.exe
- Size 11.8MB
- SHA256 42312321ed9f715987cb3623292eaedc778970b45efb9b1de62ce795f61991a0
- MD5 ffb1fef3325c772baaae9e44fe3d9a36
- SHA1 bdb2b6c0f2da9e8f3cdf002cf14abba7930c9382
- SHA512 4cd92e9e84d4af1a6bda83253e532d9f5750e5f5275112a54b860ea5ceb28015e728d9548730b3d24dfd6e043c813b35ec08b6839e84bc06d56cfa205a5a32ab
- SSDEEP 196608:4a4ppa540gzWgM04nKLNZHuwhYaCCIuvrpbJRmJxwqfe492pYsuulR8jE/tRwRUH:sppa54m04nKLNZHuwhYaCCIuvrpbjmJO
- TLSH
  T163C68D45E3A351E5C126897489BB9611A724782E87E343FB36E895B53E72BC03F39F40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  WI2_Studio/bzip3.exe
- Size 186KB
- SHA256 1b3da40211188254f12eec1ab031fb2d3e9a547ca5ed8a5efaf43fdb9252d2ea
- MD5 852938ed57708222119db9725891f165
- SHA1 a1b81761acdc2fb22fa757b8d295fe2d85d4524f
- SHA512 9fb6c5b5ce282fa1825f5db0a8b901cb14d6e21ff382ca138468ab489a11b15a30421ddb4acb7df704defd137d7c0abe40d3b296235632db0baa32155bedaa0b
- SSDEEP 3072:LUCXBQr4YRvquYaDPq1h6EzuzYD2n5/Afvjogv4ow5thpccJP5L5Wf:LUCXBQrRgLaO6Ez8oogv49JmcJP5L5Wf
- TLSH
  T12914F877E6B3C8ACC5DB92B0B78699E1B470BC584530E46F038196243B1FE606FAC9D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  WI2_Studio/cjxl.exe
- Size 5.0MB
- SHA256 e2262d72f4c1028fd3fbe420d85e6e35210df06956a5521b692a92c4f0e0d8da
- MD5 07d27fda33d900dc9d04b9c8c5f9fe88
- SHA1 ca3be45864b5f8c428a726f4397389d09447251a
- SHA512 26551c1f9950acfaa00ae26d923aaf0a906ab3c944e298b27e9f3a23cf40d4f507c3d0f9cb55e38eee4399ad9c52869aa7737c3dc72943585cc4a3da7b43cb65
- SSDEEP 49152:cFJlcT5yE8XCWV2bti4oO08yea+NfSlmcXz5LS/dfxo3/80+e5D1ruQoUn26x0JT:Gg8amFWS3U4b7KqxKb
- TLSH
  T1E2367B43B5A614ECC566C034CA5AA533AB21744E07F569FB73C082F83E66BA07F39B15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  WI2_Studio/cwebp.exe
- Size 736KB
- SHA256 6a2f5cb5dce71366353ab1d9caf9c636e039f25703acfce1c148eed346f2f72a
- MD5 71f46730b6d87c6c90ad4891eff06011
- SHA1 50885e4fd6fcb3d26bebcf6f1a678c5fcaf66522
- SHA512 6f70452e90c05dbf05ac0e07c87489799994415568c06c37a738fdc41d97e0ce05f741e0533725fa127da657a4b0bbbc946196cf647f2986c692bbf6f393c042
- SSDEEP 12288:KU/I6Bo8QvhHEUbEtkLqgXnHDyIGBSGghwCvq8k4loHsz:KmI66L5HEBkLqgXnjrGBRghllt
- TLSH
  T127F48C4EE9A621E8D46B8078C9AD661BF6B53C1D075095FB13D4AA293F33BC0573BB01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32