f27865ff8f60776ebd4febc0d8528aa3530396d4e4534ebe2b4f765e047b05aa

Sharing

Copy URL Twitter E-mail

General

Target
Velocity.7z
Size 19.7MB
Sample260802-b5ezpasalb
SHA256 f27865ff8f60776ebd4febc0d8528aa3530396d4e4534ebe2b4f765e047b05aa
MD5 34be7067f85591003987566f89d44875
SHA1 7f748c3bda15f3d0e4fde3328256dba7362cec91
SHA512 4b3e5ad786992074a46467e85cb9eaec2de7d729d804ec358ab4c0e239a4a5d463464ba8d203cd8057eb45d2dd9f1ccda5db6784b4180a3fa4ff52a5066f7213
SSDEEP 393216:xR3TMYTPpaIJz3HJedxrwR8+6k2MTYIh8ogjpH/yo+5JUYvaQTzVmeOj12BT:LoYjJz3HJePkR8XvIYIh8ogh/4vaqzHT
TLSH
T1EA2733F8AB8CF8ECB7C73B687D857AC900D446E34249CB30A967A724F2715A651F9530
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Velocity.7z
- Size 19.7MB
- SHA256 f27865ff8f60776ebd4febc0d8528aa3530396d4e4534ebe2b4f765e047b05aa
- MD5 34be7067f85591003987566f89d44875
- SHA1 7f748c3bda15f3d0e4fde3328256dba7362cec91
- SHA512 4b3e5ad786992074a46467e85cb9eaec2de7d729d804ec358ab4c0e239a4a5d463464ba8d203cd8057eb45d2dd9f1ccda5db6784b4180a3fa4ff52a5066f7213
- SSDEEP 393216:xR3TMYTPpaIJz3HJedxrwR8+6k2MTYIh8ogjpH/yo+5JUYvaQTzVmeOj12BT:LoYjJz3HJePkR8XvIYIh8ogh/4vaqzHT
- TLSH
  T1EA2733F8AB8CF8ECB7C73B687D857AC900D446E34249CB30A967A724F2715A651F9530
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery execution persistence spyware trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  Microsoft.Web.WebView2.Core.dll
- Size 634KB
- SHA256 2b999d1775004e98b32f281f4518f3952df650970748527ef5b54fa9979d6c9c
- MD5 225af3c55fbb7376a11dbc4648a2b582
- SHA1 89f5657f8bca7aa571d7b533933dd3ffe744fcdf
- SHA512 6e550daad83e85a189a6709e4757ee8caa27604362be9945cddf1a5a59aaff0f68403255422e243a7aaa2e0fea28c6972187be72b9eb82b76a4523ba3a49aad0
- SSDEEP 12288:6BfVnfFe7bqOarD6niWFynSbOR4qn7BdkJX1Il5g3dM6sq9cZwq4BTpsRkrP322i:GQcl41OZ
- TLSH
  T1D3D4532223FD4619F6F27FB9563817608FB9BC96B939D35E8598502D0D72B809DA0333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Microsoft.Web.WebView2.Core.xml
- Size 566KB
- SHA256 d2e44139c2e8e30fecb99112516964143be130c58960a2c65cabc6a2a7c35ca0
- MD5 d1757131496940abcc30af78d34598a3
- SHA1 446944afcdfaee9c22320e1f80e9ff43de92e6fc
- SHA512 c779c90b4e6b6d54bd745954185659e9eb5c76e72cb2222f373a3b0d3ad3de4307a5b306e6832a4d721b2da3836851b05655c6e90f944488674cddbc5cb66ae6
- SSDEEP 12288:rWynTLhgqUDx4OfmwT2DRG3Vt5InEvs//BKoeUvSRyGOtQ/AgJSeLdLGz40cS+jw:CNcoUCF2
- TLSH
  T1FDC43F01668CD6310DF50ACA69B8B6D8FF2D666731D3AA21348C0F570F739A2E1BF591
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  Microsoft.Web.WebView2.WinForms.dll
- Size 38KB
- SHA256 08c7014d311979c3e37ea56ae8233f3bdf363013498b11b1c7ee2bcfb29cf08a
- MD5 b76acca7a4248b6a6472915a0dfd5c79
- SHA1 ab44abcf54f42211d64fd219a94df06573191a7d
- SHA512 064fb0e7a366d26fb83ced4bca1edb2b39653d75bb0c4c4b9dfd545e2b1fb8e77fe021535478d2a57ed4a0fdcd4b39a952f320ae8fdaa2e213962732a6016ec1
- SSDEEP 768:1caNb2/itGt3JrbYbKQzZDgcEST3p4Jjrjh2je+SG2au8vxJKia5/Zi/wGQSxKFp:zb2/D8+QzZDgcEST3p4Jjrjae+SG2auF
- TLSH
  T198034B4083ECC517E6EB1E78A9B486620B7ABEC33DA1D79D1D88F1D90C7379055113AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Microsoft.Web.WebView2.WinForms.xml
- Size 40KB
- SHA256 96e468637ee3322db9851e38c0a3d7c32f0d11f60566b47ace2c91ec66179ac8
- MD5 8b30e596b9d8ec30b3f82c03941b23a4
- SHA1 c74d93633c1d669a60372f003368963a68981692
- SHA512 22419fc31380173cde3a66509db763254eebb211ea3923dc8f504fb4204d6db649e63ae6809eb84c4214576410e69f5bfe166658439890df6ac63310dceadc5b
- SSDEEP 768:3OsdyK4aSPgPxW3uyCG4yCGdryCG/L+GZiyCGRL+P1xb9zU4QPgcRJFXCfPgKehN:3OsdyTaSPg5W3uyf4yfdryf/LzZiyfR/
- TLSH
  T114130C01A28DC72249E21ACE19B0E4D4FF2D677775D6EE11384C4B560F73EB0E2AB291
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  Microsoft.Web.WebView2.Wpf.dll
- Size 81KB
- SHA256 b6a200f3dfcf2cb6c3b6e6179da0590e01525b111e8f85b94c6060456102972f
- MD5 57c8c00f0b851a4c8e6cf39a44351adf
- SHA1 bbf68f3d6e9ba8fc7dfc24a0b38e453853a1cab3
- SHA512 c51149361d5c8eae121a42694d28d087fe5a515c0aceaf7ba4c9c44bee5d6b2b397e9370cf5296729702f0c31dbd82be0c08167aac936d0cc10bbc26da4c1649
- SSDEEP 1536:mh/Ha+etdl9Zk3DcLoSJVgCthp8dYNUDHfF7yEW30bpc4Jjr4YeUq7HhvU0sdndR:mh/6+etdlWDGo/Ap8yUDHfFy30bpc4Jf
- TLSH
  T10A837DA123BC8D23C6FE1EB9786540555F7AEB837E12D74F6584B1E80CE738121123AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Microsoft.Web.WebView2.Wpf.xml
- Size 139KB
- SHA256 8932fe759bb7afd1e0de73682a9577d782048a68b252408e127cf767fc348be4
- MD5 547ebbf40b254728354b371a5beb3ca4
- SHA1 730f1d32c4145739f5865c0bbef6c3e2fd91139b
- SHA512 ad7a8d85decd87a913b94a8cbd9651389f61a3090a5bc0fe06ff2445149de59e8fde911af729a6dd65b3f0f973a6dde6250528023c36f4bb2a39ef214c7feacb
- SSDEEP 3072:xOsSyTa4PgfmLC4uyD/D4yDC4dryDJtLryDnLfryDYO/LPm8RLP9R3Ly1vb9QUXK:xOsSyTa4PgfmLC4uyD/D4yDC4dryDJtJ
- TLSH
  T185D3EC10A28CD62248F657CE2AA8F4D0FF2C266735D3DA15304D5F161F77AB1F2AB291
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  Microsoft.Windows.SDK.NET.dll
- Size 23.7MB
- SHA256 0ec371d93798852e36461c8adddbeadce0f963a04752f0b64e54fe19c1c834a7
- MD5 a00b91c2e00b89e387705af95b72bd6e
- SHA1 eb57d8d9b8c1e4434044c28b608113e49d53ccf9
- SHA512 93b88a2ef85206765144c7c082662da7a3ad57fb08af9f8bbc0355721c12cf52f6a6920adad08778c4d2054652636d24d095b998c282f9b1e92b9234808f3165
- SSDEEP 98304:POCu/R1ZTAk4bl5EUBMXyLImPbjAd+deA/tlCjvT7HiYyhILyV3K3CrLtHOpdGxD:POCu51ZTAFLzbjblIjvT7CThIPPBrYj
- TLSH
  T15D477E2297A44E3DC98F5773E4B603264335C60AAF4393EA581C979D2F833460B59AF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  VelocityApi.dll
- Size 21KB
- SHA256 9945bf0b137c9f60e4fdd18e8d77b1e7c874936d6993d9e29b70820ba39a607c
- MD5 3d3059e39636ddd2ffcbddd4d162da54
- SHA1 c19b0f304637ea162799850d03617d021121e7cb
- SHA512 8756ec8ab8782ac734bb5cedc3b9ae2a6a87a167e2b23d59ede7e4b1b64eb3cb1d32b5fd62ced093e3dde9c164a1e26295e1b36818fd4b862a0337db832d999a
- SSDEEP 384:hBwpwnR3zxm2p6iThnjsL3BHsxxSIRtJa+hLuv266mNEQEQrzdaYU6Ud:n62R31BjOHcDRnryVVu
- TLSH
  T185A218087BF88265F5FF8F786CB082100677B9166432FB4D1CD251A92D7BB904A90B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  VelocityApi.pdb
- Size 15KB
- SHA256 66b9a07080e7024268a2139c4d97a683f54d9cad4935cecb8edaa22f58305b70
- MD5 c40df810762c1293eb6bf12992c8465c
- SHA1 ffc22afc0c7a7e92513764b1ef560d8d26cd1ee6
- SHA512 0900b42f0c3c858ef829f4c847801d221d3b1ae7eaa9a4f1c43b449a4799b9f115d9459666b18be7dd334632f408e9b0e1ed103874b95eef479c78b4041b11d3
- SSDEEP 384:6YCDCaaArmLoLFw2/sfaIvz1d+bShoDRnfUJoqiWNDKrpQHRfax7EsHS3U3Bucxi:6N/awmLUYoMhd3QZg
- TLSH
  T1F672C3379B5CE265C9952A325836C2CC77B1C3202716EF3AF0D86668EDAF74A07B1174
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  VelocityLite.deps.json
- Size 4KB
- SHA256 e28716662c6aa158eecf9dcb2171990abe0fb62e847c8949d11b181e0c9a3dd3
- MD5 cf140d04ea6cd51c541a5ed38177d6a9
- SHA1 e3dd3bdc07f509af18e4a3ea22c34dd9bbd2badb
- SHA512 d123fd4b6e5d64e1626da9d66ef5b1f8e8c2ac05d64a856daea81f270f42c50ee05bd217897a7786b48200bc2b20c1b85617ec02a3aaa4e087b13f2aa5c3caf2
- SSDEEP 96:tjn+smsGAcUb7PqZw3uwGhorDgZFTsqxGI6:tyQb78hffc
- TLSH
  T14191461BE8544D6744706BF6587646C1FA96136F60405E8B78FC162C8F73EE6A098F38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  VelocityLite.dll
- Size 18.6MB
- SHA256 3867a2b72d32cf68210086edf0c94305578c3dbadbeb3f2bdabb3f79888bd9f7
- MD5 69674db1e8505fc001ba1bb544ffdfcd
- SHA1 10b7d17291d38a6fc5280c5db2e071290a53c068
- SHA512 b3d9d78c3a4369f6b948ba7f49f2259c5d59fbfceed6c989345d8fae762e4b343e814cc1b424eccc82d75ee4b7cd892b0f6aa7819ea03425a1d609955341636d
- SSDEEP 393216:pdtwpHrmXuabdwVorMb975j+ssedCCxr0DGfRJ9A8q:pTwpHrI1gowb975j+SCCxQJ8
- TLSH
  T100171247F389DE2EE25B1B3686730394A6359CA1BF5B030FA41A76B8AD733C01D146D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  VelocityLite.exe
- Size 232KB
- SHA256 c4c0b8e1593bc5481521cecfce00b953e3ee6d7323b98e7ddf2e8c90a78ce545
- MD5 e4df8ee6e755c3da3088701eb1c05b76
- SHA1 c52dbc1190b84555e27649b9b54746b958e5f3cb
- SHA512 623ae06db60f42e33c6e94b4d74a20d6e456a1edb94e2b8bc58424532f27bc5baa516465cad455bddc0351e21614d4965919a123b7cb0891b8527021928a09d5
- SSDEEP 3072:IlDJk88wN1QI7sxrYL1peQ3lOY9SkHNwG7NzaAT56Q7BQz:UAIwxrI14Q3kYBTM5QNQ
- TLSH
  T185341903B65890BAE1A2D638CD928981E7727C594F71A6CF37507B7E0F766D09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
behavioral25 behavioral26
- Target
  VelocityLite.pdb
- Size 52KB
- SHA256 3b46654c9ca149d72163936380c307a6e2a1790abf3a930706228bc2ec1b61f7
- MD5 a29489988054906ab1df5fb0aeeff44f
- SHA1 decd089d57b822de66559f8313f416968741d859
- SHA512 fa35746c134fae793692ac051e814a04759479ff4a7bf4a51ae19121b3eb79be3e32331ad1386d5ebe436f022c7345f6c7bfc78c53c888b9f5404dd74a00a98d
- SSDEEP 768:5mHFPanigrSFK19f/kOHBHYuoGqd36DST5I5NHlhhm60Okx3eXOCG:5mlubuFKNBUB6DSFI5NHVzkxX
- TLSH
  T116331962D35CD306D759A97588F381483734C25CEE47DF2BE188A279FE667200EB32A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  VelocityLite.runtimeconfig.json
- Size 519B
- SHA256 96bc2946dff8790400d652ec7f8de7bb043e954980d59470c112788b68a1fbd3
- MD5 7e4444b5a3e3cea574693f055f944011
- SHA1 04dfc98aa994475e2803241a1d55bb4277dbb8da
- SHA512 2fd5e7ffd3b12c6962d3ed7d7b99fa09b870173623701690cc0237529c32b008e219e48818a0bc4b6962fba2e3d161b8fa8ce38c03467329b0ddc9e58ef0ae8b
- TLSH
  T1BFF0276ACA106DB708B933BAD52AC182EB30532B10041D52B5FC081C6F776B21111F95
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  WinRT.Runtime.dll
- Size 516KB
- SHA256 bcf3a14e8712a90837fc5c0d8c8a24696af2bd7f74e9767597ec81ededfb23db
- MD5 edb1f8d15fe41838cd449141187ae032
- SHA1 c7344afcdaced6911ab5288b0ade76f66dd41203
- SHA512 5756ccbafa1440d114f8d9b163ea0c2678300ba24c9979b837ba232cc6813f74a29fc0a23b9bc1d7f53c6ce5f15cdacd6804a755ac816116536c56cd9ca43c0e
- SSDEEP 12288:A4Yh4z+uZSlne+7/SQ2YaxhaNHav96iTtqen:HRSucPTx2YaxhaW
- TLSH
  T12CB44A80A7FD9A1AE7BE1334B03416144B71FC17AA13E39F674895B81D637998E40BF2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Checks whether UAC is enabled

Drops desktop.ini file(s)

Enumerates connected drives

Suspicious use of NtSetInformationThreadHideFromDebugger

Downloads MZ/PE file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32