76658029da14cca9f6fdd5fc6043851ea76edbe54f5c56b7325beadeb599ffbf

Sharing

Copy URL Twitter E-mail

General

Target
76658029da14cca9f6fdd5fc6043851ea76edbe54f5c56b7325beadeb599ffbf
Size 4.5MB
Sample260731-mr3dls1wet
SHA256 76658029da14cca9f6fdd5fc6043851ea76edbe54f5c56b7325beadeb599ffbf
MD5 78f890dc493171c58da1191c84a39531
SHA1 b6bf80e5a5173864c719d214f7401f94b423dcff
SHA512 ce6310a6ee4a84a2e7d53a80c65d9ba8460c3bbf5e8498dfb11d4162650c4351cc7be59e4e891bf03a6fea75e34406cf91f3fb2336b838dd1bfd46c9580563bf
SSDEEP 98304:iMzQ/mLLa/wqYa7tVuyUtGaaWbe6LWJdRlNQLs+WxdGSx7WMef153+gEJmQBWDjg:ih/mLLaoqTJ8tTbDLWJf/hx7WMetB+LP
TLSH
T11A26339A546D39A6E801B030F0CA81F3EE225974BC25AB7B2F720407FDF31479A59677
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  SxSCleaner/1WinSxS清理_在线.cmd
- Size 31KB
- SHA256 bb234ee59473f18aee3589b8702d15ab23e4ef0eb410f58892dd1974bdba53d3
- MD5 a64e5c94aea4ffc027f786715120509f
- SHA1 553c9e722057fe848726b82ab8fa7a898ae6b08e
- SHA512 fde9b640c2e6c33d63c2db6719394b0218656d1decf66c724a6877bedc8b9c442fae8cc66ef7a770243a5fc48cdc60f20421680d9ce6a835feb977dfd4f7a152
- SSDEEP 768:O/3zYqUAbfpZBVWfAyDLgfgeD5oZMvebrw9JrmbLMIX/+omKhhv2n2FIxldvyF:DAbBZvPJD5oZMveb7X/+omO2nZdvk
- TLSH
  T1EFE209264841807294B6AB3BD52A05A3FB0BD14B3120965D348CD0EEEFB23FA807D7DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  SxSCleaner/2WinSxS清理_离线.cmd
- Size 29KB
- SHA256 7051fa871b6ad8cd79af5fc25823118a50b059ee02801197b6138425a7f74e7b
- MD5 9fe605fdc9f9d8db785e4ff39ddf77cc
- SHA1 a34c7c1390aae1cb91f855e210590cf7352c2eac
- SHA512 36d856bad83c6291c63c7e4eb0f31519f6a22338b55e5bb9f5df3b44c3724332b90918974348bf123fc1b9cce30ce3e25e62dde4b60ff58e89fd967bb541337e
- SSDEEP 768:O/399vcbrUPJiFCoZMvebsFe0kdYCHE/+omz3SvLbtixOgQ:epcbr0oFCoZMvebSCk/+omWLb8xO3
- TLSH
  T115D2C7564971807254F1BB7AE62A05A6FB0AE14F2520D35C3498D0EBFF763E2447C7E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

execution
behavioral3 behavioral4
- Target
  SxSCleaner/Output/Import_Packages.cmd
- Size 155B
- SHA256 6dbbd57a06eb71f57de0f3f25aa2c0df0f1ca4e715deb5e7344a3ba61de08170
- MD5 da27f3673cff9e36a6a8269c88ff9035
- SHA1 c053ad2b40ae7fe5abbf087c53feceb26643b0c9
- SHA512 d3d6eec27a2b0a6aa90d6630225f2a6ab7fa7771ef35ea58f1aa9476e65f2b30b702ed1d5df53541f5dbeb8cb3bcc6227b8253839309df3854c5b17e17090b65
- TLSH
  T146C0800E35DF8B15E970449E1535429161B55561240017D17593B111B505544BFB0557
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution
- Executes dropped EXE
- Loads dropped DLL
behavioral5 behavioral6
- Target
  SxSCleaner/_Helper/NormListExtract.vbs
- Size 625B
- SHA256 cd2c2dd40e23a43f9c0dcae052da776d9769ffc3a62bedc8e0706164410686ae
- MD5 30712182bccca52ee30c6bfcbdfc9cef
- SHA1 9eddf441a7fabd5c5718db0faaf7e29230186aab
- SHA512 9628a6d00d0c7bba4b0055ec2fc77791dac8332b9a4269876ed00a65d03a4cc452d7e7bdd3f6639af38e87d4d7eed9ec70428d5e01f50f233c46fc10432379c9
- TLSH
  T13AF0A40DBE07C756C3504383147FE95F8F988878AE72D4D8A88ADD59382647BAD62CC9
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral7 behavioral8
- Target
  SxSCleaner/_Helper/PathExtract.vbs
- Size 770B
- SHA256 2adbe6610b692cdbf037dc240073a83d2cddd7506bd77f239791d4c89b021275
- MD5 f932e1a0a453f7e80c498ee83e903d9b
- SHA1 658d0ee7bad31ad46a5e03c6623c705bbf19ac9d
- SHA512 770e86db226feac7e10c98406dbd3d5be2a438e51069a3d55822634e8e4aa20110c61ade6ea0d1c17920b6cf2303c7e63f060dbbe508175be6068db03946bf16
- TLSH
  T11E01891D9F05C6468630028332AFD45FDA4884BFAA2540FCBC4DCCAC371902E9E94EC4
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral10 behavioral9
- Target
  SxSCleaner/_Helper/RemoveApp.ps1
- Size 3KB
- SHA256 85f05ba74b0939ea3803385637c04e8f97a8c571d4f3cab6f9cb7b41e7b65701
- MD5 34918e6a86fa2314f46c567a03971158
- SHA1 be0b257d523c74917095fff7a7c37761ebab8fac
- SHA512 9afe1759847406c9c39bbec43889336c959a10655f446e3e1669e95ca3bd19b7654f1bc4dfe8515de1e6b757561d0853356f8312feb7db748e444012c295b585
- TLSH
  T18761E01988950E9A15732A3F79E80118FF0C703BB08001E4FCAFA298AFB485D751BDDA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  SxSCleaner/_Helper/RemoveAppxManifest.ps1
- Size 760B
- SHA256 d75fe1df335fa319286284972b26af7facea67c5f14f98394e7173a41c2e2b37
- MD5 d57c11b04712ac250e480908a431d41f
- SHA1 0e03fd96676a48be57c2e51dfd97e57f7777692e
- SHA512 9be19f573259621374148e869a7f48d080c7dbaf8b8ed8404965cfa39e55c20393bf1335271e1239f1f5e789bf84cd1279dbc16ed4c7c09edda8f1cba6c21834
- TLSH
  T16801D0B64225D5E103A1E5B2234EFDEC627A3249425E7910FDF4D28C63C0B9866F945E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  SxSCleaner/_Helper/StartCleanup.cmd
- Size 393B
- SHA256 e952e398bccd7c5e0914ddda3effe5124e00c59a14ed0564d2f4610f73e9d72e
- MD5 1920eb4173e755cf92678689044a7021
- SHA1 e48bad95d0469a0ccbf4f9ccbe27d584294bdb39
- SHA512 3c3d45a26bffbad125c8c396946196d28cb7f13610b7161991364615dfb6acb32295ff0dcfe32b859638dcfeb1261e90540ce209ced7425c5c801bcb19d27a65
- TLSH
  T1E8E0F1181085C7274183B071C3A3114BD12FAB8A9C14BCE0F147C704880C694B1D15EC
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution
- Executes dropped EXE
- Loads dropped DLL
behavioral15 behavioral16
- Target
  SxSCleaner/_Helper/SxSExp64.exe
- Size 31KB
- SHA256 98e921c0959449636bac8ec07248dea6407428b6ee756316d08987a2d1eee623
- MD5 5e414184a5478180e8f69d851d21cbe2
- SHA1 96c37123bd547b3a187937ed5a380391c8e4c80e
- SHA512 5eb6a3a9388bf5f6a8beb203b124ce58cb4376e63c3b74c014e77b43fe70a076334b54954da03cbe3e50a85624bf6bb507442d09b8fa74f4559c695f5ceef722
- SSDEEP 768:uXt0uQ2RFle9SAjXcHZMBoae6H7UvPrnvgXZ:YnFle9SAjOSp7UvPrnvCZ
- TLSH
  T1E4E23C4069D94668E2B35232BEB2A157FA3975534B39C7EE70CDD11A1FB39C08933B12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  SxSCleaner/_Helper/SxSExpand.exe
- Size 85KB
- SHA256 9e889abd2d6068bc59aededc64a45d96e04c7ad5cb1d70f606f8ab0a96433b4a
- MD5 ca13105c6b1a532b8aeec611ec6459ef
- SHA1 9758ecb1797e4037da3a20d117119129b6c3454e
- SHA512 12eb55abfb3cd97286f8d47c9c561cde1efbb025f356bc3eaa7b4665a75ec48364b31e9aa9ff2e68dfbc06a0b56a49ae46550acc93f65afb83402322d592d2ac
- SSDEEP 1536:FBhcBqEuO81aWG5mINIRkPOybxHC2sfJxJ7UvPrnvReCs:NmqEG1aWG8ImRkPOybxi7xxJ7UvPrpeC
- TLSH
  T1BA831903B6E19434E5B22BB46D3452256E7B7D666D38811E7A9C4B4E5FF3A808C36323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  SxSCleaner/_Helper/SxSExport-Mod.cmd
- Size 7KB
- SHA256 9208f941a7ce5c76df107220875fb450a78075a429730e35de17d724647d0106
- MD5 ee4284e1a6bbe78ed28d3b1a6e07e3e4
- SHA1 95a3fab02ab87c4422f80478334dc217650966bc
- SHA512 e224c1e16ce24e6307d38ee326f13408091d6ccb213b90b191bc61c1e40f28dd4983a0e2341b40c15b7d7e090b658f4bd5e3592f772a9b20c2909af85944bcc0
- SSDEEP 192:l+qCBiy3KIaQ95dQtk0AXvhySjsDbWHERVQ:lrCBiaKIaQ95GtkfvhfaYkVQ
- TLSH
  T1A1F195271E9002A974B0FF6BB27085D5E589D0EA253896EE311CF1B8F61D2E8153D3F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  SxSCleaner/_Helper/SxSExtract-Mod.vbs
- Size 34KB
- SHA256 ed680ff9d38fde6a464e98410ef347c6a9f36f827e022c44d9dcbfea3b7f595a
- MD5 7867251938f445fc68d45f44cb392523
- SHA1 e73dfe5f09858e6a6e31b033180964336f32c475
- SHA512 eaa18a9c386d4135a94fc75a5c1f3920fc24ec58c43331f1f0aa4a65e627be85de3f62c283b10a608e8ee0d0782f1201577357b533136672c22e7ef17096bccb
- SSDEEP 384:agVsJPu9QqeXBoUEubRtoCSovtdQsIfwg/IxE/b5cf19S1YHURiMBZAAl:aOhQqeX0ubnCo1S1fwgH9T1YHUH
- TLSH
  T13BF2EA3BFA8EDB585F04AA50663D080F897D8275017D01ECFBBA09D6614D9FE90784EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral23 behavioral24
- Target
  SxSCleaner/_Helper/Tweak.exe
- Size 44KB
- SHA256 afbf22880d0129f8b11b1a5876f175c874f52c8572cb5c4beda3c528241a8e6c
- MD5 ba352663c76c86c10a8d5c7b7a47f3c5
- SHA1 61337aec0dad3d993f862a2d6499a185cbe46431
- SHA512 fe563a98a4aa7913d4e58be874669f3294f07954fbe53d4b599b294310ba83181ff0d1fad947d23678cc62afca2a26aee39217d38a662b4aee097135488a706d
- SSDEEP 768:2YXjpZtla2TkbZQG+udRn1d699cD/vBiLeiQw:7XjLa2TkbZQTudZjKI/w9B
- TLSH
  T14023E641A3E88119E6FF0E7568B21250C677F8479D32DF1F289A115E1F6B6808D62F73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  SxSCleaner/_Helper/WinDefCtl.ps1
- Size 25KB
- SHA256 099edf4825651907bc782955ff7bd15dfcdd14dcb10a690abd5e75ce7b7baece
- MD5 1fa5695bd0cb67f85bba907a1a509190
- SHA1 12e414c54ed7da34f45ab83a6c4002b8ed727b25
- SHA512 73ff42246b370e5c046dea441140585b3e38b65e1f1514406e73528ec594605dbb1b1cefbf1c62e64d430a5e5e84e025c461470182144318aec61fade7f1c7bd
- SSDEEP 384:55NdVx+I/CegmXFxESdvssiqa0jSwz7eCCxgCLUJ5Gd:5umoSS+zt2Li56
- TLSH
  T15AC26399B9E4286A4BDB407F1C8B902D7D35046B748C2D05F84C86D0FFA53249FE99BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  SxSCleaner/_Helper/amd64/FastCopy.exe
- Size 1.2MB
- SHA256 9de842076379b67b76a0f987ec9c86023bc4ad9e8f0b6089266dc8753689cdd6
- MD5 bb95809e4acd58cff11f731691dbe0ac
- SHA1 56a273535fd4ca167b0c0d2defddf687d4234b2c
- SHA512 290690060beb625f91d73f6d01be02289e3c6c9bdf30a9bb18c3ce249d3e50b83252b0836b333829e5e98035f55b0e6fd26ccc0829b449db4919865dcbba3458
- SSDEEP 24576:CGtlqQScsYW5G6pCMcy4jIt/dxu+K8cy/ZL:CGtlqQLsl4jIHxNK8PZL
- TLSH
  T173456B46A7A500E4E1F7D938CEA34656EBB23C550B30CADF22A0565F1F73AD49E39321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion trojan discovery execution spyware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Downloads MZ/PE file
behavioral29 behavioral30
- Target
  SxSCleaner/_Helper/amd64/NSudo.exe
- Size 13KB
- SHA256 b26357fe89d69590daa4ef65fc5e2e36f161f70cbbf10f545f818eac7945e217
- MD5 69bf447d25f973b5e85be4638cb7b7b6
- SHA1 1734bc67d5e4f743053f697d5bbb381583a6ef72
- SHA512 e67797240ebbe516ad4cb4a90cdf22206e88bd198fc93e11122ef3fb63558d71f196ffb631698ef4a5e1ec7b19d366c83d8a5708ee891f2329120d37f7f9f1f5
- SSDEEP 384:32ctfaT/5eRVd3cxwr2h8RHYhEw7QGWhT:LaT/6VNcV8xlT
- TLSH
  T1A2524C96DBA811D6D06546F5AFF38F8A74F0BB511B1602CF25B492850F5A3E2B23F207
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Executes a VBScript file via the Windows Script Host.

Contacts third-party web service commonly abused for C2

Downloads MZ/PE file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32