e9c57280eb3a7a76b769ca7b99f610f7fe1d0600e514798689a003cf0c11e5de

Sharing

Copy URL Twitter E-mail

General

Target
PFA-1.1.0-setup.exe
Size 2.5MB
Sample260803-3ff91adj8z
SHA256 e9c57280eb3a7a76b769ca7b99f610f7fe1d0600e514798689a003cf0c11e5de
MD5 06a4effb1982aa8f604516040025450f
SHA1 7d345824daa2f8e8e4aaabf91dfa2bd63be40c99
SHA512 051d0f63577263705254195214ceb30b1460f8b715b969c0aa5450c78887d941450f5a22fa0d9ac0bde299d5fcb27f335fd5347bdc374e794c0ed25b7db5a814
SSDEEP 49152:ojYDYpCPgmHLrLrVF5FaheCjpWY88SOYgCZtpdiAG5OerwFPS3L1u:ojC3Fah1n/igASUf
TLSH
T162C5338B73818896C245A7F96E5B5A7181726E9DB5C38C074F253BC7EB7C213C35A20B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  PFA-1.1.0-setup.exe
- Size 2.5MB
- SHA256 e9c57280eb3a7a76b769ca7b99f610f7fe1d0600e514798689a003cf0c11e5de
- MD5 06a4effb1982aa8f604516040025450f
- SHA1 7d345824daa2f8e8e4aaabf91dfa2bd63be40c99
- SHA512 051d0f63577263705254195214ceb30b1460f8b715b969c0aa5450c78887d941450f5a22fa0d9ac0bde299d5fcb27f335fd5347bdc374e794c0ed25b7db5a814
- SSDEEP 49152:ojYDYpCPgmHLrLrVF5FaheCjpWY88SOYgCZtpdiAG5OerwFPS3L1u:ojC3Fah1n/igASUf
- TLSH
  T162C5338B73818896C245A7F96E5B5A7181726E9DB5C38C074F253BC7EB7C213C35A20B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery ransomware
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH
  T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
- MD5 c10e04dd4ad4277d5adc951bb331c777
- SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
- SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
- SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
- TLSH
  T17F12F8675A4041B3E9A3223D306A3E3F8B7C9325D0927C03C677AE566AB031A7D3A354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  DSETUP.dll
- Size 87KB
- SHA256 def6f245762be36cf18b435ba8b7ebc224b9c21d1a1db606a8e8fafdaa97bba0
- MD5 9e0711bed229b60a853bcc5d10deaafc
- SHA1 2bea53988bd35c5df5c9edcef0bc234c37289477
- SHA512 c0b31872e52c8f4270d991c70d1a1c9ef9a4bbee4807c54c05a449cd1607506ab16ff1e74b378651b36e3276322c86cd843565c8a1aa33a49c47322ef4df0185
- SSDEEP 1536:OtBqvGpPmOEll4RWxiF9G3ZnVdqkFKJuTJbHo0Xm+jN3i97ZTj4FWMD+ZJqsHPCH:OtAvG5mOEll4Roi2pVVFKJuTVtXVpS9a
- TLSH
  T1CE937E2176A0C176D4D7207875ACA37216BEB5B10BB880CBBB4617E9DC713C1BE3931A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral4
- Target
  DXSETUP.exe
- Size 524KB
- SHA256 046041aba6ba77534c36bb0c2496408d23c6a09f930c46b392f1edc70dfd66de
- MD5 ddce338bb173b32024679d61fb4f2ba6
- SHA1 50e51f7c8802559dd9787b0aebc85f192b7e2563
- SHA512 7a63925278332c8e7949555383b410d8848a7834b85f34d659e351ba78cbe4d2ec09caccb2178d801b9b68725c9cbae48a6a1f07f0804a0c41eb51df79b7eca4
- SSDEEP 3072:ti6LKecn5W6VOX6dRJar+GHs6Hl56MA6rKmMH2/5Mjt4zT1mFDYkCIEVNUrlfw0I:3F0JarNX6hWs4VRKs
- TLSH
  T169B49F5077F8D925F2F32B743AB9E26549BA7E80A934C60D2601525D1BF3B00E968F37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral5
- Target
  d3dx9_43.dll
- Size 2.3MB
- SHA256 84b900dbd7fa978d6e0caee26fc54f2f61d92c9c75d10b35f00e3e82cd1d67b4
- MD5 7160fc226391c0b50c85571fa1a546e5
- SHA1 2bf450850a522a09e8d1ce0f1e443d86d934f4ad
- SHA512 dfab0eaab8c40fb80369e150cd36ff2224f3a6baf713044f47182961cd501fe4222007f9a93753ac757f64513c707c68a5cf4ae914e23fecaa4656a68df8349b
- SSDEEP 49152:dbCJsk4VlPXA+15Om5wxw9Qsi55K+31BhZ64nW:YIIBnW
- TLSH
  T17CB5486172F4C1E4E32A9039B597B20BFAB1304907188BC793E04D9A5FE6BD46CFA355
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  infinst.exe
- Size 81KB
- SHA256 8c62fe8466d9a24a0f1924de37b05d672a826454804086cddc7ed87c020e67ff
- MD5 a7ba8b723b327985ded1152113970819
- SHA1 50be557a29f3d2d7300b71ab0ed4831669edd848
- SHA512 60702f08fb621bf256b1032e572a842a141cf4219b22f98b27cb1da058b19b44cc37fb8386019463a7469961ca71f48a3347aaf1c74c3636e38d2aea3bca9967
- SSDEEP 1536:uOPXfyLm7r2P25504T+kGvNcD9QeZu/FOfNlpaJrxO1wh:usXfyLm7rGo504TzucD9HoIfND8xO1wh
- TLSH
  T182836B9933A410B9D1AB927CC8E24B05E7B2B496473693CF0368469A5F23BC55D3E733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral7
- Target
  d3dx9_43.dll
- Size 1.9MB
- SHA256 0b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f
- MD5 86e39e9161c3d930d93822f1563c280d
- SHA1 f5944df4142983714a6d9955e6e393d9876c1e11
- SHA512 0a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3
- SSDEEP 24576:8UtU6OIyl2Wy9M3bJ45fPS0zFZghQ6aOiFaKOE31GrvFXl74YZ29X1MDd6olmrBs:8566l2u45BiNYFrz31Cv3D29kd6kWa
- TLSH
  T14895AF51C5191075FDE69030110D32B2219C9B316391ABCF665E2ED9FFB8BE1EAB8387
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8
- Target
  PFA-1.1.0-x86.exe
- Size 598KB
- SHA256 a8bfc3cbd0076c2a0a8e26b06d52b4593831cc1f3e0b31bfb9cb5db6ecf4b6b5
- MD5 b2fbea052907a4403c62c3581ea76c9c
- SHA1 52ee82cda514ab1a2f96b2c2e3ffbc39ea7f3375
- SHA512 9ab177b0520e1950c800620fbfc542c3571992f78d4432fca5dbfefbe7f05c3b47e624e27bb76b6afb329ca9aa21bd5208152cccbe338399ca18762a452f5777
- SSDEEP 12288:w0BFdT+S9wJy4LkuJdC3Ulp5e0C1la9GSyIo6GmztPvvw8WytIII//tAwsv:X6pJFrRtPHwutIII//tAw
- TLSH
  T1B5D47A25B6A1C172D4A20274CD7BABED593ABD600F3545CBBBC43A2E3DB06D16B35306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  PFA-1.1.0-x86_64.exe
- Size 665KB
- SHA256 8bdb156e3f7ca0e1a9bb684ad95069084da498a9c8f676821049d97a08b968ce
- MD5 16ee9babd6410552f4c7da3b1f612cbc
- SHA1 d0172916ace5fb381b060ed92945a8974c9ee92e
- SHA512 69fd0ba1e99781f9dbc24b8fb082c3d3de596b8bb39abf30b04fe33ae791dcbda1d922006fd41997d5963cbe0d0add008216f21b972fec548daf9d0c57f524f3
- SSDEEP 12288:dwE/Uoah+RBkgA9n+YduJuJj7319Gg2Sw8WytIII//tAw:18ok+RBkBUYduJij73ig2SwutIII//tj
- TLSH
  T1B5E45B59B3A806F5D067813CCEA796CAE7B17C150F219BCF4650B66E2F33AD1493A321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  Uninstall.exe
- Size 61KB
- SHA256 598e6e1e5c3d07e42df41432bc7ab41456a7e90a69871cd85a447fc8da5dfcc5
- MD5 a23c6c0e996d0b1f00b7dbf13eb995b6
- SHA1 a1f501838d67a59cf7dbe7238931ef5edc0e6247
- SHA512 a095c91454adeeae887b7923a1b3555c90784197e9b73ab2f4b4cf4d6b9d68720f1a7490c1bd75f16ba8c1961a6c1be6403d76daabd7f0759cb870578fa3cc47
- SSDEEP 1536:xQpQ5EP0ijnRTXJegUlHBLeAa9gr/x4e+i:xQIURTXJeplReAaCGev
- TLSH
  T19F53BE2A32C1C4ABDA26023209F7D77AE3B2FFA5171206675B503F7F5975286EE01187
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral11
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH
  T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12
- Target
  dsetup32.dll
- Size 1.7MB
- SHA256 642d9e7db6d4fc15129f011dce2ea087bf7f7fb015aececf82bf84ff6634a6fb
- MD5 0f58ccd58a29827b5d406874360e4c08
- SHA1 ba804292580be6186774e7f92e6dfb104e46bf25
- SHA512 3e3d4f2de5dc5addc86765a2f888487ea0c9ee0208fac60187ddaa9a2bfd73cfd7734836d32805fa43222470c8f6cb9a10e2a099aef72c67ad7c789096e57ce4
- SSDEEP 49152:MjnIXtNeOOOOOOOOOOOOOOOOOiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWq:YIjma
- TLSH
  T145859E31B1D40332EA7203B177118AB7F63EEB9DE119D565B9AE825920C2B9CC37E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery ransomware
behavioral13
- Target
  dxdllreg.exe
- Size 78KB
- SHA256 b6f134915bac6d630adb04d69f6944462bf5adfce2182f2908c2fb1bdd2da2fb
- MD5 967240f77a123434ce212ed77276dea1
- SHA1 ac1ff591a5ba91b382578fb9f9b38d2de6379bf6
- SHA512 30efe2e1e3e8221a0b368eec5a7e030efb04fd3f4f9d3f678d0eb2f7af1c5d5484d8bd7c8bcfd0bf349b87a34e6d779e7966fe004c7defa12eee4a33bc51af07
- SSDEEP 1536:c3yqLKmzPYxsbQwTu9pS7OOC8c4aEuW/jGboizXyz36WBAOMhowYkrgHB3DSSSS7:wyqLKmzPYxt9PJh4aEuWKbx7WmDhDgHF
- TLSH
  T157735C11B794D036D892617849ACAB314B6E7DA1077883CBB78407EEADB16D05B3C3DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral14
- Target
  dxupdate.dll
- Size 168KB
- SHA256 6dcad858cc3ff78d58c1dae5e93caf7d8bacb4f2fcf9e71bccb250bf32c7f564
- MD5 94202f25810812f72953938552255fb8
- SHA1 c1e88f196935d8affc1783ccf8b8954d7f2bfb62
- SHA512 65b66d07ef68e0d1e79f236a4800c857e991ee3ff80ece4cfdd0b5f6083ea16f8a52d351c3af721cb05c06394ec91b4b5e3cfa4b0f0879f7549f3e3ed035e79e
- SSDEEP 3072:By6LKSOwGi/9S7BLfsdg3/Vhxo4yYbfBu20jPzwRFvxdGF4EdRDWXGTHzh/KV8ce:4wGaI5W4/Vhxo4BJV0jLwTGF4IDdPEe
- TLSH
  T148F36A15B740E472D5D20178711C26235AFDA8B117B980CBE74B2BCAE9E53C0E67E36B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Drops file in System32 directory

Deletes itself

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15