81f30c1bb33c7881cd4e6a0dd835b7f186d928407dc56e50d1959324e2396772

Sharing

Copy URL Twitter E-mail

General

Target
amm.exe
Size 136.6MB
Sample260801-hdt3vsfb73
SHA256 81f30c1bb33c7881cd4e6a0dd835b7f186d928407dc56e50d1959324e2396772
MD5 f939bf76e4a913ac43e7ad15139a8e04
SHA1 7729d085b560ff0931826c39cf8dbc22f42f23a4
SHA512 0a383d266e690ceb2abd575427522790f7e17f624ed16ff448d19750a9aba55f6e44d1982d2bb3026e4bdb02c5d5894da84cb474b5c58f643457096e51f0f6d7
SSDEEP 3145728:rydOwC2/IEZt/FRYgLptukO2daOWd5v4mCuRasT:mA2/rh/ojOuR5
TLSH
T116683350D66AF69CE58D80B2DE72BA73B806D62C91520D0E6A2F7510F071A2734EFD4F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  amm.exe
- Size 136.6MB
- SHA256 81f30c1bb33c7881cd4e6a0dd835b7f186d928407dc56e50d1959324e2396772
- MD5 f939bf76e4a913ac43e7ad15139a8e04
- SHA1 7729d085b560ff0931826c39cf8dbc22f42f23a4
- SHA512 0a383d266e690ceb2abd575427522790f7e17f624ed16ff448d19750a9aba55f6e44d1982d2bb3026e4bdb02c5d5894da84cb474b5c58f643457096e51f0f6d7
- SSDEEP 3145728:rydOwC2/IEZt/FRYgLptukO2daOWd5v4mCuRasT:mA2/rh/ojOuR5
- TLSH
  T116683350D66AF69CE58D80B2DE72BA73B806D62C91520D0E6A2F7510F071A2734EFD4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery ransomware
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $TEMP/TEMP/Agisoft/Metashape Pro/python/tcl/tix8.4.3/OptMenu.tcl
- Size 9KB
- SHA256 d3b5df03dc0ef449d75e91acaaed9bd7e6a1d30cef079e5bd50479892e6b0a71
- MD5 d5cfc2430e08d31175224d228cda98d0
- SHA1 30311d7698990083a4039376d442b7868f53075e
- SHA512 401652e56a7a4c7fbc250a3cbf671ec1be6f45c0bf76c3e921641f11f28711f481a87474b388531efe4587254dbe81f85fe39e425713ef1d6dbc3dee413860ef
- SSDEEP 192:J+Fwtr0EwPsvyO57QT+OX7NvOJ0OLpTencoRuNO4jbb85hzhivU3w1F7tl2X:J+wrNuc7QT+OpvOuWoRuNOm/i9gfdlI
- TLSH
  T16E1202127D060405E272E3AAC9F59915EF33B2BF9042646D3845927C3FB4922B5EEBDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3 behavioral4
- Target
  $TEMP/TEMP/Agisoft/Metashape Pro/python/tcl/tix8.4.3/PanedWin.tcl
- Size 28KB
- SHA256 4883f6355fdcf66fe229f10cb33a2c5609cf2de7ac5e241875ad828f7add03aa
- MD5 1c9d2b96b7e23ca1b55f503fd73f3817
- SHA1 6c671abdc4bc481ed6d162d378ac35f91d66ea57
- SHA512 8e9df1faa99bb14ef012784c29ae83e6810ac9208693f85ce466e5602338022b7b2e4ba7312840b801870dc0c8cb768884a28493d7587a359ed416e89f67eab6
- SSDEEP 384:LjgtcjP2j5Larh5pfW3kW5i8y5juN+bNZS4DOxOaq+15c+ocnB6UamU8PsG:LO4vk0W513+0B6UaM
- TLSH
  T126D2111B3D4544C4E272E6B6C8FAC215EF63B1BBB492914C784441A8BF7002779BD7EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5 behavioral6
- Target
  $TEMP/TEMP/Agisoft/Metashape Pro/python/tcl/tix8.4.3/PopMenu.tcl
- Size 5KB
- SHA256 2565b9f95ffb0aa2eddcdd1c5efd05f480deabba11425c217647504674f67628
- MD5 ffddc3dc5b799059a33a843782e2b2aa
- SHA1 868ac39bb2efd306dba00bbd558d98d30c18e3ba
- SHA512 4d0032d756ac15cdc3c3d28f761f10b6beb968e48de58e04f6c7e2a087b45c377954d174baec9af1a8ef2e9bc2a1d7c89f2c293202cc10cf2ee5f510f87d3553
- SSDEEP 96:FjrPEQJmt0ts/SFwR7Psypm3HDzFyZQGkQ/2B2WZLPLAt9839WBtHTEPE1k4Fn:9rzJmatsKF4PIHvS/cZZPAA39WBtzGEd
- TLSH
  T185C1E0526D824427E135C3ABCAFA943AFE3390B7264678883845806C2FF652569FCD4D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral7 behavioral8
- Target
  $TEMP/TEMP/Agisoft/Metashape Pro/python/tcl/tix8.4.3/Primitiv.tcl
- Size 10KB
- SHA256 ef1ff46f0169258ae2f0ac0fd840d3f58231c6825060b787a3f0f8a5052752d9
- MD5 d6735950cf9c70c3c326799762a7f95d
- SHA1 a57dbdfcbc5076446ff948fae23e78ded61c105d
- SHA512 8260838924fa82537809cc0fb36c01d54daf6243084213c210a34952c0f879e1cd09086f7793a619ba723ccb2b5cb9059ccf462f4cba93b28ca5e47fe72f994e
- SSDEEP 192:bKzbKDtiq6Lc3Cw7DFcpj7Hd/IjftzIwzY0H27RHPFVHIhu:sbKDtiqJb7Dupj7HCZssBHMRHNVHIhu
- TLSH
  T13C3287227F42413AB373D37384B951A8EF36A0EBF211195C7C9DD164373096669BE2CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral10 behavioral9
- Target
  $TEMP/TEMP/Agisoft/Metashape Pro/python/tcl/tix8.4.3/ResizeH.tcl
- Size 13KB
- SHA256 9cd973d3de2385a0f665ce1c8bf2a8ada490f6eb396a4e620dce31e72a0d120f
- MD5 555cb43282344d72d7c9acf5b1fd2081
- SHA1 874f34c56eac015ba7fe8c8392b9655162fc5112
- SHA512 01faae6fcc4ae592913ad54420678387377fb2dfb4e0ebee9cfe01d2873b211da05aabee5bde2e54037de7980d583639e442f58eadc5aa090a42dda817725398
- SSDEEP 384:/RLzbsJbspBm7DKBuShPxRyWh5GWLWbMb4E:/HTLWg
- TLSH
  T14C52CB9B7C4909A6E230C2328DBA811BDF13F36FBA5268CD389590643F7016B74AC795
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral11 behavioral12
- Target
  $TEMP/TEMP/Agisoft/Metashape Pro/python/tcl/tix8.4.3/SWidget.tcl
- Size 9KB
- SHA256 7965659057591e4bc091fa276fdfd58670d99d70d264e4a54ac74c3a80e84e04
- MD5 8c10360cef51dbd3e9d11d83201239a2
- SHA1 0936e4adf439bcfbb0335c250a5b471ea2123b13
- SHA512 964c956cf8cb813c19693abf78ab72f87e3a3bcf1b52c8285079e7becd81b684608e5658e31945da90aa53a45785a1bb9cccef391b4a221c21432a4277d7918a
- SSDEEP 192:rcszc1ixtUt7DQfRe/FtjPX07/ekeilyiffNfPSf2vt:ZixF0JeId5t
- TLSH
  T106220E453E020469A2B5E376CDF34B25DF72F1AF8A45948C3C4856693F7013A6AECBD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral13 behavioral14
- Target
  $TEMP/TEMP/Agisoft/Metashape Pro/python/tcl/tix8.4.3/SWindow.tcl
- Size 7KB
- SHA256 13e80a6d76aeb91e2fbf5d36d831f3cde55e7b8f54ea5611c5c49fa648179339
- MD5 6d18607b39c23b15ae15262985a3624f
- SHA1 550684b0b7010f75c030353a0b604201214dddf1
- SHA512 7470e7874a7023e6abd5935a27d8ec0756117612635e4a7e274fc60bc8bab5155f83d7a762cc1deadb53c9c5e8eadea4dc0d683ec67eeb3f9b066686351e06b6
- SSDEEP 192:i/tV440EE9DvODeLFe1AVDKDT1AVDK+ykwDKtw:i1V440hOz4yJ4NykoN
- TLSH
  T1F9E1DC133D000454A6BAD232CBF7EB69DF63A1BB9612844C305692A47F70137E5EDAE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral15 behavioral16
- Target
  $TEMP/TEMP/Agisoft/Metashape Pro/python/tcl/tix8.4.3/Select.tcl
- Size 7KB
- SHA256 b67b23f24c5f4334bb9da6c0db8fd664f2903879ca64bd1804993df9e1635af8
- MD5 4b9d398a0572434288a29c7f0aa8aaf2
- SHA1 0e50c289a8231d3ffcb01102f3077afe4f941ec1
- SHA512 8ccc1c93586242a50dbd2adb6407fb43cc36a9524f1aabca10b08b23cbd1b3e3330d0e7e239b7b8ae0f344b9cd454d7fedc89aeb78ca59e5c141da276a91516f
- SSDEEP 96:FwsBfBWEEJ/GtQg3LE7z1Z4tf0wZwoqWs/3Vh7XAEDevrwacRwPWvRQ:bfBWEEJ+tQCL0Z4tfzWDAqevowPWW
- TLSH
  T163F110427E4A0079E231E367CDF65124FF73B2FF9151219CB88891BC3FB491269AD986
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral17 behavioral18
- Target
  $TEMP/TEMP/Agisoft/Metashape Pro/python/tcl/tix8.4.3/demos/samples/CmpImg3.tcl
- Size 2KB
- SHA256 e7b212552a1894aa206d893d7482db1043f540a0ccf6e75c1149224d750c4f02
- MD5 c9512dca6ad7244da895b1d13b9c0d0a
- SHA1 51362fafe15ce6d205e20454202afa067f4c1fbc
- SHA512 505692dd5dab5f857b3bf7453fca8314fb78b48282928e021d0dbd70c87df55f8fcee0fd74ca61ac9c33dc8df46d03c1226c08738b7b2bf3774403fded1cb4a3
- TLSH
  T1DD511F9272C221CBD1318135237AB209EF520EA351CEEE4D785CC2844F7D2BEC5BDA88
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral19 behavioral20
- Target
  $TEMP/TEMP/Agisoft/Metashape Pro/python/tcl/tix8.4.3/demos/samples/Control.tcl
- Size 3KB
- SHA256 00603e5e7409dda458d5d11f45fc2e77e71e93ee846b2b1021a429002145dd45
- MD5 be947f6e83b11b3aa2437aad9670b57f
- SHA1 b910fad24cdeb9479fc32b3f00a9e61ebd689bcb
- SHA512 f7cd25177bbe929fd7e824194f8c82468605ef29308aefff75c530fdecf71c4de11b873c31dd5f57d7792c7e31fc020c68644b34044633ea9958ad6e32d5385a
- TLSH
  T1F5715343624013A441B2677506F8CB59DB45819793E758DA785A803C3BF0A2E63FDBEB
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral21 behavioral22
- Target
  $TEMP/TEMP/Agisoft/Metashape Pro/python/tcl/tix8.4.3/demos/samples/EditGrid.tcl
- Size 6KB
- SHA256 94ff581a620a08c4c5ac9ac16a7efdd6dae05f9d16d9aebdbe3e3f0cad7ea712
- MD5 8d60faec3d6658b7b65160c49905bf8c
- SHA1 15fef2060c018e3e100e7019c58c9de2722e50e6
- SHA512 7efbebbbe9d2739881d9964054a06ea0fed177cae4e0a0573e1dc322a3646adfe4d99d3140ae2ea1c05bdb59d88c49d66360d54a7a2965f04f211fb605553701
- SSDEEP 96:AfaA/PqW12QzzDrsmLiSILKgewm25dJiHNyk34E6hD1Kf1R3i:ACh+/PtuRg4CHkk34hhDcfy
- TLSH
  T19BE16553A6667B2A9235C3B1C0F99B0EEB2C45DBBB4AF19C748982110F352206065DFF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral23 behavioral24
- Target
  $TEMP/TEMP/Agisoft/Metashape Pro/python/tcl/tix8.4.3/demos/samples/LabEntry.tcl
- Size 2KB
- SHA256 88899f54110824d56d7fb57f5ecd5b97eaa7984c13e53dcec05d1ba1f3e8b8b7
- MD5 6f637a2ab3fc9668c46bad352139608e
- SHA1 007a930ba8853a6b600c70429eec9ce1273fc16f
- SHA512 1dfde049fec150db346fa58e0e1b9dc147f149e319c5b3217c087cccd583739fbe619d05dcc02acd8aa2369481a966c8ec72823d191f9c582ace2de2d6458574
- TLSH
  T1C9519243624013E590F07FB106B88648DF6081D363D36CE9B849A0283FB1979B2F5FDA
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral25 behavioral26
- Target
  $TEMP/TEMP/Agisoft/Metashape Pro/python/tcl/tix8.4.3/demos/samples/SGrid0.tcl
- Size 3KB
- SHA256 988106b37c6e5993693d18a03368d0e1a84b8f95114b1832201c6361ff3c9e1c
- MD5 3ac35bdac135a07b29e71c4674f7fa22
- SHA1 378dc41ad0470779c504a90e521e34a85fdbca4c
- SHA512 5a2e5c4e6a81bacbef794425cdb1e20628d0c493a3c57aa0f4c7556458498c95b4fef18f5d3372c75aa1ebb9641073e234b802d6ff67764dfc43c450ce3f78b7
- TLSH
  T1E9716403B2876764BA32C37091B996CDFB1546E740D9F89EB88CD1295F3087781B87D9
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral27 behavioral28
- Target
  $TEMP/TEMP/Agisoft/Metashape Pro/python/tcl/tix8.4.3/demos/samples/SGrid1.tcl
- Size 5KB
- SHA256 cb0388c09b46aeb8828b36e6c3dd804456339731346c4839b2d6e87aba31e6c8
- MD5 f1abede140bc7048eb8e8ddbb6e50460
- SHA1 1a8c3546e11aa6f541e04789368ed6a006c65c3a
- SHA512 0969a92641ccbe9a8526e8a34cd5219ce9460dbaf2b0d596d0e2b7a9f410880067bd13d7f147f80039019eb24dc281674798fbf1c2fcb02007200067d7f7f99d
- SSDEEP 96:lGfN2v2ZKf0XPg2yghD1jf1GUg2WqVpPaZjauWgncmU3i:oa2ZY4PSghDFZg2RjaZjauPUy
- TLSH
  T130C10117A1876248F132D2369275F18DDF2EF1EB82C6E58EB48D903D2F3046543B969B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral29 behavioral30
- Target
  $TEMP/TEMP/Agisoft/Metashape Pro/python/tcl/tix8.4.3/demos/samples/SHList.tcl
- Size 3KB
- SHA256 5884fea04ec99096d649ad1c7d389d179c05b6cdd5641667270c1e2b73d3990c
- MD5 224e6f60d7e68be97af5deca922c89c7
- SHA1 72eace1e07bf27810867bed887d1a31e305b0285
- SHA512 d8cf16d02fd0be93a9dba3e3c814ed1ff87ef9528fa0aef3ccd99f91d1c76a1521b7374b25267db5e7e745e822380d3f9ba4c5f50e366e83f0c9bef44553f907
- TLSH
  T15F61A7028241339D31B042B3517E8909E7EAC1D791C268ACF89CE03D5B279BA65BDFDD
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Enumerates connected drives

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32