af0fbaf13a9879fef202ad9fdd94c44e7cc8b9775e723eea45fb145b9d1a6480

Sharing

Copy URL Twitter E-mail

General

Target
MediaService.zip
Size 26.9MB
Sample260730-kn3tvsx1ct
SHA256 af0fbaf13a9879fef202ad9fdd94c44e7cc8b9775e723eea45fb145b9d1a6480
MD5 91d4e985537d0bc429fa560723d74b51
SHA1 28ce2bcefb4defcdd0457b68aa111dfc4b7b8f3d
SHA512 7fd12f50667b4b1502ac0a9f6bbb35a53c98fcf3b7eac33147ee2e38756d5f9f25fee08a138cafa6f12c25c3c3431609efaef94e209b9d6406d3f45bf6a109f1
SSDEEP 393216:NLUqHEq6ExUPOoUR7zkDG6jtf1CVLUmGmYYrO2tZUtWcvKuZvgWlfj4GwSmCMiu+:NIqku3ODG65gVflvftZOWiDhkGw5JO
TLSH
T16657333D48F4249DE0483438572B1B0DFECDA6699E4E7A28E593288477DFCB05D2D9CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  MediaService/Scripts/target-fs.exe
- Size 105KB
- SHA256 d39fc7599cdb742a72b9b1ac5133e3a33375e4e76fd8f9ed3fc411bf8be8bda9
- MD5 9f4ce1e98d8f5e43c9f8e57cd6205df2
- SHA1 a0adb5160d0aa4fad8f52b9c39357e1fdc880f26
- SHA512 ed4273ef47ce7b2745eb0bb0da4bb0c921b5a78677507230511bd02157a8c1467df73b0923f478bcb4f5e9e23ba20df0760e56dbdbbad7097d10229bca63d2df
- SSDEEP 1536:1966Spw1RSGXwStXQR1mTqZh52bAGXHnDtCdGgYluexaNSxFfHYTo+G6H:j8wDSRUT0kbAYn2GgYlBYN2fHYTo+7H
- TLSH
  T148B36A0A33D420FDD0675274CDB69A15D3B2BC2A4674934F27A47B6A1F733826D2E722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  MediaService/Scripts/target-info.exe
- Size 105KB
- SHA256 74098b1e5539660d8386197c74a2a1e74003fd7eab3d7f8e9a10f0c53d1c2981
- MD5 8ff135383283d5e5ed1564eb05433b1d
- SHA1 194754d2a2c58eaf59f1f77706fa54cccc7d4018
- SHA512 d001cbddac3dfd0b8f1503251cc92fa43d5ca67ffb058b664ee2af8efa774311b0378cc6c76464945487fad6f307a7128db5db3360df9b08be392fdb57ee40f3
- SSDEEP 1536:1966Spw1RSGXwStXQR1mTqZh52bAGXHnDtCdGgYluexaNSxFfHYTo+Gkg:j8wDSRUT0kbAYn2GgYlBYN2fHYTo+1g
- TLSH
  T123B36A0A33D420FDD0675274CDB69A15D3B2BC2A4274934F27A47B6A1F733926D2E722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  MediaService/Scripts/target-inspect.exe
- Size 105KB
- SHA256 48c752aaab8e9e4e5c3b4c3a58aa3e38157acc06e33ce5a04f795b460f16f4de
- MD5 2b4a0bb9d35f39a77f16466cd4583516
- SHA1 0ff331e9fed5c8615e2d28be898a3e185e891526
- SHA512 9d223d30245f2236edeb0627656f33667aa94d23eda2b3906b1db19b82cc6cb6cdc6f6864a00b9f0ff1a6ee5b13440239f55f6dbed49298f6f109d0694a7cdd6
- SSDEEP 1536:1966Spw1RSGXwStXQR1mTqZh52bAGXHnDtCdGgYluexaNSxFfHYTo+GLu:j8wDSRUT0kbAYn2GgYlBYN2fHYTo+Ku
- TLSH
  T1E4B36A0A33D420FDD0675274CDB68A15D3B2BC2A4674934F27A47B6A1F733926D2E722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  MediaService/Scripts/target-mount.exe
- Size 105KB
- SHA256 58b5f0097e644e4c653f4996cb766ca5ae2b5265d12a64289197fc44b2f54473
- MD5 64ade31cf99307eb548acbe17187dc11
- SHA1 1de776ef9d2b7759dfffddb883caf0902135b708
- SHA512 7e50c01ffd6e252802e064411f1f589d4bcb0cda923175d246053f0f126cc731b09050d8b8f82e2cbca8970ba3c16168d5410d255c25cdce6e85c6f3804da751
- SSDEEP 1536:1966Spw1RSGXwStXQR1mTqZh52bAGXHnDtCdGgYluexaNSxFfHYTo+GoY:j8wDSRUT0kbAYn2GgYlBYN2fHYTo+lY
- TLSH
  T119B36A0A33D420FDD0675274CDB69A15D3B2BC2A4274934F27A47B6A1F733926D2E722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  MediaService/Scripts/target-qfind.exe
- Size 105KB
- SHA256 0660ae82f2d3f647d2f30e76287a2e4634a266007b395739affd487bdb49b7fe
- MD5 5b4a593342069e26583d21b975909aac
- SHA1 3d62547d5fa5b1dc47507fd4b4eb773830c75515
- SHA512 9cca56e7c45392df6824bc2de2fd61170fd676c3a40e571f7127cd4bfdd49cc541528faa35e6dcaff4a18b348dd79da38c1e0cae29176c96d7b01232d282aee5
- SSDEEP 1536:1966Spw1RSGXwStXQR1mTqZh52bAGXHnDtCdGgYluexaNSxFfHYTo+GIh:j8wDSRUT0kbAYn2GgYlBYN2fHYTo+Jh
- TLSH
  T153B36A0A33D420FDD0675274CDB69A15D3B2BC2A4274934F27A47B6A1F733926D2E722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  MediaService/Scripts/target-query.exe
- Size 105KB
- SHA256 19c0ea8dae9966563ca41a7be9ce7497e0eef95891acbda810846344a715de69
- MD5 e73e4e5a2a1851c4b442a5da7fd54a97
- SHA1 0594330f772115989f2852d08aa0f56b0fc4dd51
- SHA512 c0ca0cc11b20bff326618ae046fd82252af66419bc73639144dea746818a19b5f5f42ead4badb82a728bfe1e39302bdcae0c8cb6c11f5afb815c08e7f38f9e52
- SSDEEP 1536:1966Spw1RSGXwStXQR1mTqZh52bAGXHnDtCdGgYluexaNSxFfHYTo+Gx6:j8wDSRUT0kbAYn2GgYlBYN2fHYTo+Y6
- TLSH
  T1D9B36A0A33D420FDD0675274CDB69A15D3B2BC2A4274934F27A47B6A1F733926D2E722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  MediaService/Scripts/target-reg.exe
- Size 105KB
- SHA256 7a46ee8eb06054d8539e3f1f1faf7a5a43b2f9cd2c93f5b6b61457a623b4f0f5
- MD5 de6d8fbf0df45eb0337d7145fbba7c95
- SHA1 6e496ea8d81ff18ee9712561d86af164952e8353
- SHA512 a00119cc2ad309aa98e18822ab8ca838f7ab477f41b5ae113431c079f2134b55f795374e6b1752372b2fa747ac8d9690a3e29ddd35b1aa2115f0b4b3e911b7a3
- SSDEEP 1536:1966Spw1RSGXwStXQR1mTqZh52bAGXHnDtCdGgYluexaNSxFfHYTo+GjM:j8wDSRUT0kbAYn2GgYlBYN2fHYTo+GM
- TLSH
  T1F5B36A0A33D420FDD0675274CDB69A15D3B2BC2A4274934F27A47B6A1F733926D2E722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  MediaService/Scripts/target-shell.exe
- Size 105KB
- SHA256 7220f3de83a9e22e4e61752b56d940d0136d868484efb5af7a319e8a03f171f2
- MD5 65e40d9360194a366574983ea7237159
- SHA1 051fe2e4bdbc536bc6932e6ab9be722fdd365e37
- SHA512 a414738bffd073bd951b05842a1c9c74c0ee6248a53870c1dbaa98c9f906615fb3095bea5245c0ba6176d8e7f606380a90afad79d475f2507f40d22d18754887
- SSDEEP 1536:1966Spw1RSGXwStXQR1mTqZh52bAGXHnDtCdGgYluexaNSxFfHYTo+Gal:j8wDSRUT0kbAYn2GgYlBYN2fHYTo+Xl
- TLSH
  T1F2B36A0A33D420FDD0675274CDB69A15D3B2BC2A4274934F27A47B6A1F733926D2E722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  MediaService/Scripts/target-yara.exe
- Size 105KB
- SHA256 0afcca161256a5e703411cae597473a986174ff325f504c88e8bcc80a99caf4e
- MD5 64c7fcc613e644a63d9089db8535db2e
- SHA1 e9b9caddce2bb0d8c7aca525b0135420b2c6bce4
- SHA512 c6c7b27f8ab64864d03c1379c8ca754b816a7497a859e98d8b0e49369e51dcdbc6128244b32927c04a5bf3907241a09fd99928964906cbc23939b96c71b21a4f
- SSDEEP 1536:1966Spw1RSGXwStXQR1mTqZh52bAGXHnDtCdGgYluexaNSxFfHYTo+GRk:j8wDSRUT0kbAYn2GgYlBYN2fHYTo+Qk
- TLSH
  T14CB36A0A33D420FDD0675274CDB69A15D3B2BC2A4274934F27A47B6A1F733926D2E722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  MediaService/Scripts/thumbcache-extract-indexed.exe
- Size 105KB
- SHA256 e0e037f8ec23628461a958cbaa9a3d341e3b8917ce2cc236b01a7ddba34fdff5
- MD5 e903707ae2d3d0dc2ffc9d00827b1daa
- SHA1 f8c97a3453fb2effb1aac297e1ed8470086fd6b9
- SHA512 21f5c978a1733c14a63f1c9416f528fd86520dfb04e006891dfcee33b8022f7ee6dae24cb48a66bcd73d3d2f4be8b10eacabfab8828ea3af9bb58a0f1d8ffe8b
- SSDEEP 1536:1966Spw1RSGXwStXQR1mTqZh52bAGXHnDtCdGgYluexaNSxFfHYTo+GUX:j8wDSRUT0kbAYn2GgYlBYN2fHYTo+1X
- TLSH
  T19BB36A0A33D420FDD0675274CDB69A15D3B2BC2A4274934F27A47B6A1F733926D2E722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  MediaService/Scripts/thumbcache-extract.exe
- Size 105KB
- SHA256 dae7621d4f2e53f8f534c43a7578507719eacebfc9c21c6a3085b55aec11fdc0
- MD5 e783aca0bc4e8773aeacc089fcd95563
- SHA1 09a1314cc0d83eaf1eed6afd8490b6abd92f115a
- SHA512 73ccbd3219fa3e59853053e64fa923f16a4f979b7b5eece1a5a28558f63feb8d3a17db59eee96d1cc05f8c91aaecffecd952d8dddc82c43212994bb3f1ec7678
- SSDEEP 1536:1966Spw1RSGXwStXQR1mTqZh52bAGXHnDtCdGgYluexaNSxFfHYTo+G/T:j8wDSRUT0kbAYn2GgYlBYN2fHYTo+2T
- TLSH
  T1FFB36A0A33D420FDD0675274CDB69A15D3B2BC2A4274934F27A47B6A1F733926D2E722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  MediaService/Scripts/tqdm.exe
- Size 105KB
- SHA256 def4256ed79bc5fba54ca6bc39a10d697502f4f7acd46e6ef558d039a62fbfd6
- MD5 4720bf7b9109abffae2ed5b5eaff778b
- SHA1 7424f74b630bb2f08efb8241417acbee8921b50f
- SHA512 8fe74eaa26b18c7a2b12dfc5f8fad6a0e4112c8198982e71f5d6d8803478d9d6e1450b0ad79f3592448449e09a17ec27ad2bdb2276365ad94ada38fe16fa89cf
- SSDEEP 1536:1966Spw1RSGXwStXQR1mTqZh52bAGXHnDtCdGgYluexaNSxFfHYTo+GXz:j8wDSRUT0kbAYn2GgYlBYN2fHYTo+Wz
- TLSH
  T1E3B36A0A33D420FDD0675274CDB68A15D3B2BC2A4274934F27A47B6A1F733926D2E722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  MediaService/Scripts/vbk-extract.exe
- Size 105KB
- SHA256 c95a6accd5062a202a6bbb1f9cda82cbc23748265e98c81a243c5a9581f1c73e
- MD5 ccfd09794b908b970c959e5f438ef802
- SHA1 a387249ef1415bcc465fdfb9a7f568e161748f1f
- SHA512 2cd002c216d9cc2fb0f2bcc632c8816d1f91b9645ff05af18262bf515cee3b926fc6802992cc6347f81b383b8b65ee1f8fadd2356fb1d79255a968d5f1b50732
- SSDEEP 1536:1966Spw1RSGXwStXQR1mTqZh52bAGXHnDtCdGgYluexaNSxFfHYTo+G2q:j8wDSRUT0kbAYn2GgYlBYN2fHYTo+zq
- TLSH
  T1A4B36A0A33D420FDD0675274CDB69A15D3B2BC2A4274934F27A47B6A1F733926D2E722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  MediaService/Scripts/vdbbin.exe
- Size 105KB
- SHA256 2dd9aeed9f878062b621dd4030490b5df7e7d5b7e5f599386d839dd31a5bac07
- MD5 9791fbc654dc595fae45f4718bd1bc88
- SHA1 9897b7d41fb6e8c596ff0572487a0d8837bccd69
- SHA512 18a31958073fa5f9bf5644c090aba6f6a643925448bef5c121ae679bee97388af735a6526a0e80ed470ba8ca15680af886f8efccecd6b21587ccb093675b4950
- SSDEEP 1536:1966Spw1RSGXwStXQR1mTqZh52bAGXHnDtCdGgYluexaNSxFfHYTo+G7i:j8wDSRUT0kbAYn2GgYlBYN2fHYTo++i
- TLSH
  T1EBB36A0A33D420FDD0675274CDB69A15D3B2BC2A4274934F27A47B6A1F733926D2E722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  MediaService/Scripts/vivbin.exe
- Size 105KB
- SHA256 035e56aa933bf8b91e1cd19a2b9937bc729f70dc6bb5b20975d4de4c42e72263
- MD5 1f1b12f3fa399b4a8fbbcba9fb318802
- SHA1 d4e29d3007806aed868fa6703ea2e73150e933dc
- SHA512 d8ea8c268e2f1e61d334c81984ccfc4ddd732b2df9e726416ba554661b76a3210c13945b4b24d1a0157cc18084354c6a78be988b93ea9e892fb1ca5e7eb28cc4
- SSDEEP 1536:1966Spw1RSGXwStXQR1mTqZh52bAGXHnDtCdGgYluexaNSxFfHYTo+GeS:j8wDSRUT0kbAYn2GgYlBYN2fHYTo+vS
- TLSH
  T1F5B36A0A33D420FDD0675274CDB69A15D3B2BC2A4274934F27A47B6A1F733926D2E722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Downloads MZ/PE file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  MediaService/Scripts/vivserver.exe
- Size 105KB
- SHA256 9c1c631c25dc11f1a0276aa3542976b79eff15a9cd65b92ab31aaf8d39bff182
- MD5 615796a124b256f89bb5192caf19216b
- SHA1 589380e847e20a3948bf7bf9a92130fbb109e6c1
- SHA512 2b5fe8b29cc92f0a6fffc57bdd083c916bea99583570847b7e201bc9fc2df0054a78a37ba72fffa9a7c58fb3390ac9753c12fbaff8c5a5c7286eb4ec1cc8b911
- SSDEEP 1536:1966Spw1RSGXwStXQR1mTqZh52bAGXHnDtCdGgYluexaNSxFfHYTo+GBF:j8wDSRUT0kbAYn2GgYlBYN2fHYTo+QF
- TLSH
  T15CB36A0A33D420FDD0675274CDB69A15D3B2BC2A4274934F27A47B6A1F733926D2E722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Downloads MZ/PE file

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Badlisted process makes network request

Checks installed software on the system

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32