a050291cf75e873af25aa7629f8412119cb5edad033420eb909517a0eb6192e3

Sharing

Copy URL Twitter E-mail

General

Target
WhiteheadGroup.co.nz - 5 Release of Information.eml
Size 10.5MB
Sample260803-q6hvas11hs
SHA256 a050291cf75e873af25aa7629f8412119cb5edad033420eb909517a0eb6192e3
MD5 9ad32d93c85812d3b50e9008d8b4480a
SHA1 34a52ddf06ad7da801eda3da39b87cd7a4159da2
SHA512 f07484767e31c8374dce7696f2785c9de38732448379ce82cf173e907317ee76d6d175e8a8638b61ece2e0aa72618acad0949d06623e2d99a7395b1282feedd9
SSDEEP 49152:RDoJvSBurr73TP8DoJvSBurr2bK5dmhKbFkg/4wBbK5dmhKbFkg/4wPbK5dmhKba:p
TLSH
T109B61221CA570DDB4F818667B07D3E927CFCA9CB85A842F2035E5AF070F4974CBAA855
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  WhiteheadGroup.co.nz - 5 Release of Information.eml
- Size 10.5MB
- SHA256 a050291cf75e873af25aa7629f8412119cb5edad033420eb909517a0eb6192e3
- MD5 9ad32d93c85812d3b50e9008d8b4480a
- SHA1 34a52ddf06ad7da801eda3da39b87cd7a4159da2
- SHA512 f07484767e31c8374dce7696f2785c9de38732448379ce82cf173e907317ee76d6d175e8a8638b61ece2e0aa72618acad0949d06623e2d99a7395b1282feedd9
- SSDEEP 49152:RDoJvSBurr73TP8DoJvSBurr2bK5dmhKbFkg/4wBbK5dmhKbFkg/4wPbK5dmhKba:p
- TLSH
  T109B61221CA570DDB4F818667B07D3E927CFCA9CB85A842F2035E5AF070F4974CBAA855
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Authority to act. pdf
- Size 532KB
- SHA256 5cc33d3d581aa4751bb08beddd39abf83b89a9e5af2f6b26c059d9256a610251
- MD5 ef7344299b1fc7a4bf47be0c78e0dde4
- SHA1 e717f93958afff6095f18759a7a06537e0f909b3
- SHA512 645a51289d377bd9197a6d8c1d1de272e631c0c4484f8115700de0a8bf417f5b3242fb07c81cff6133b6de38686d63143c92a79485ada13d78592616ecae39cc
- SSDEEP 12288:/hR6WYZ7wTGL3JQWtlumPxNRLWww1lDSURyMahjekP:5kwRWfPxN4d1lm9TL
- TLSH
  T12DC4F12BAD9119A6941FC7E47F02194C173A3F5D85D27ACE146A2DCFB9A337238CE019
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  Letter of Dismissal without Notice - 19.12.25 (1).pdf
- Size 1.2MB
- SHA256 2f04e88cbf393514b252bcae46caf46043ac72ae23672b020d0db12f1ddbc91d
- MD5 a9eafa6256433213ce3f61ec78813c23
- SHA1 ca10c22245cbaf7a2aa114c21e38c94f059f09a4
- SHA512 c995fcaf97712a42cacdaaa0b5b65aaaae8adc507d55e8a99c5764606d02ba8991b1d992f64108cf172319a67c219d0f5a7be5d2b7002171dc84e7f4822313ed
- SSDEEP 24576:A8hDFU7whN6wH3iUHZq4s00Lh6hyqz2yk/fMvKYuCFTRprsEuWWpiIP0:AUO7wawXx5r6wzsYuCvprjutpiO0
- TLSH
  T182552342E224D51ECF8A0455FDD61A8D3784A9343DFF3A4E034BB9EC355D8092AE8BD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  email-plain-1.txt
- Size 471B
- SHA256 bfbebf74becda35e18c726aedbb3e67894b491c3970b154256612973fb610720
- MD5 d2336653ae29525fa44270ce5912063f
- SHA1 df440d416dced60c68823a39eca6db0a04bafadf
- SHA512 b3adba40aa24b69b3240259a952820cac6bb2c4d1b553d85efcaf13ab2d72ba628376f272f6cfefe289383eb33f4147d1616b0f840c811842593af83b77b49a8
- TLSH
  T196F0D457C7858373583107A6474B0993FB24605C53924355584E8214226FFB6956F8D6
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  scan_260105-095228.pdf
- Size 532KB
- SHA256 5cc33d3d581aa4751bb08beddd39abf83b89a9e5af2f6b26c059d9256a610251
- MD5 ef7344299b1fc7a4bf47be0c78e0dde4
- SHA1 e717f93958afff6095f18759a7a06537e0f909b3
- SHA512 645a51289d377bd9197a6d8c1d1de272e631c0c4484f8115700de0a8bf417f5b3242fb07c81cff6133b6de38686d63143c92a79485ada13d78592616ecae39cc
- SSDEEP 12288:/hR6WYZ7wTGL3JQWtlumPxNRLWww1lDSURyMahjekP:5kwRWfPxN4d1lm9TL
- TLSH
  T12DC4F12BAD9119A6941FC7E47F02194C173A3F5D85D27ACE146A2DCFB9A337238CE019
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  attachment-4
- Size 256KB
- SHA256 df38f7b9b243084c94023c23e6fccbfdcc106deacf1b0132922d63f6227807e7
- MD5 7d093a3cdba278b3dd9a148e253be539
- SHA1 1ac90018d5a583b00443f66157ec36a8eae16ea2
- SHA512 6f8a4bba2bf7034db3a8d79b193f37017b63e5693951d4e5785cb2860c8a3adb43e909f9db10afe07a80d6fc056733bea90d405025f4662da524707372f3a279
- SSDEEP 6144:z4rejB0WBnxqujPfkcpp/Wlhxc6DbjkGp/fTKK3:RB0WBnxDlLwcWkGp/2K3
- TLSH
  T1064412215D0E2EF393010AE3E7FDA6C9791CB79FEF8222C2156D96C921979F918C3449
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

adware spyware
behavioral11 behavioral12
- Target
  AA Terms of engagement Nov 2022 (1).pdf
- Size 175KB
- SHA256 309b4c9197d7a62e31eee9fcf37a9afa2d38cfb097e4a30ab1ed55c34e810e32
- MD5 fc81b814a5a155bc26fe0ebe89115bb8
- SHA1 d7998c8d3ab7b088d7c52b1d3b4a282efec76872
- SHA512 f1c5569609add5c63830d1985e87e8af57eabfc6239f091f8295181461419759d51a8cb91066fc6877b904c51de4f0c23c49263cf8c402c1ab57107fb3512fc3
- SSDEEP 3072:i4vm1bgitV4aDo/HcdkXunfpADImGxBXYdVQl9I+a1mFsnw9ajA8n:Jmeitdm8dUufEU0VQornC18n
- TLSH
  T13604124A49800A2EC0D53BFAF358EBF8DD4658D256643172748ED89E3B01D75FE602EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  email-plain-1.txt
- Size 1KB
- SHA256 a2ab4e2979ab82ccea0669f1f19c2f0a008002446c9591c7eacddd671c4d87d0
- MD5 b1e571fd76cc7eb42f5cb1813158b736
- SHA1 a6cc2b5a3bb17171ff2f11277ee372667dfd80aa
- SHA512 ddc6712d6b558174cbac47c1fd72170bf5970a142e45047a905fe406f2fb705cfe8069e8e6531ea8a1e7482beb06e6a65c112fa987320df078c38d839565f0ba
- TLSH
  T1A43140DF538B826207200184EA9E3EA6FB04807CD7874AD5B45C435C235ABA5927F8DC
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Letter of Dismissal without Notice - 19.12.25 (1).pdf
- Size 1.2MB
- SHA256 2f04e88cbf393514b252bcae46caf46043ac72ae23672b020d0db12f1ddbc91d
- MD5 a9eafa6256433213ce3f61ec78813c23
- SHA1 ca10c22245cbaf7a2aa114c21e38c94f059f09a4
- SHA512 c995fcaf97712a42cacdaaa0b5b65aaaae8adc507d55e8a99c5764606d02ba8991b1d992f64108cf172319a67c219d0f5a7be5d2b7002171dc84e7f4822313ed
- SSDEEP 24576:A8hDFU7whN6wH3iUHZq4s00Lh6hyqz2yk/fMvKYuCFTRprsEuWWpiIP0:AUO7wawXx5r6wzsYuCvprjutpiO0
- TLSH
  T182552342E224D51ECF8A0455FDD61A8D3784A9343DFF3A4E034BB9EC355D8092AE8BD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  email-plain-1.txt
- Size 4KB
- SHA256 326ca3da024590df819097133e8db369545bffadcb247e5c2599a39314052dc8
- MD5 5e09ad074869ba6b37fd147e5f50990f
- SHA1 985ea384ce861a47b0f4d951c0bddd2062ad0e36
- SHA512 a5dec66b90f74b8de92b31ab98dcc9a40724f2a58ce0f608d534e8cdb5f8e2ae61128ea9d41202cc7b53b9c506fcf0707ab48e4be52418d7055fffffe3c9e899
- SSDEEP 96:jRTuffHFH1BUKnw5z27JOZmMxmg6vWOrh7+cgyD74diXK+vQxtT:jtMfHxPKm3MMgPSECQb
- TLSH
  T14B91088BB70B5375467383C2601A92E5E725A09CA35D55C2309D51BC1325E9F43BFDEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  attachment-7
- Size 3.5MB
- SHA256 6b97208038be51b7965bdb34c38c2c5304f739f6952156e3f99d318e5e3073ca
- MD5 05f45c6df8cc903e0e3bfeddc0096e0f
- SHA1 cb8dd7302ef2040e4c712d121ca857d455b3afe0
- SHA512 158ab02ab4af205452bc72fe578d676808de29d46baa1455f3a7828628eed303a2c7429299b75a5ac82e2b1b8940fb64837f656ede366967b829db7fb441d3b5
- SSDEEP 24576:6Svwed0VPAiaMrPXWoCpm6wdoV7fVduKSb0vAnj/g9W8VIiIXhJz8wMTSvwed0Vh:/bK5dmhKbFkg/4wFbK5dmhKbFkg/4wH
- TLSH
  T1D3061232CA470DCB4E519B27B07A3A627CFC98C755A802F1038D9AE470F89799FB6C55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

adware spyware
behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22