368a32bb8558650e685cfac30b891947b817e33a18d3e10a50fcb05440b7e764

Sharing

Copy URL Twitter E-mail

General

Target
paXCry-0.5.1.1-windows-setup.exe
Size 9.0MB
Sample260803-rff4fs1gld
SHA256 368a32bb8558650e685cfac30b891947b817e33a18d3e10a50fcb05440b7e764
MD5 0d2af18ddbb064134c1faebe5fc833e9
SHA1 efeb7db618bbf9d4ceebca44912989ecd1baeed1
SHA512 33c20b115b0fe1c401c620032ed0277fab1068be265f4b1c798fdf85e8af9e294e0a3019f63d58defd7a91817245efe08cd950119d32a3025f5a977ceda5b448
SSDEEP 196608:uq2Pv9qE2H6RuHh/iGqjeNNeR3UOMhF1c6LUzyjTiZsjKV4wj0lcJ8Eb+:uqSqE2pH5q3Mb1JLE8ksjgxQlDv
TLSH
T1D396332CF219A4B1EA7611B24873929F5A2B4F7BCF35925BDEDA13354DBBD601E83004
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  paXCry-0.5.1.1-windows-setup.exe
- Size 9.0MB
- SHA256 368a32bb8558650e685cfac30b891947b817e33a18d3e10a50fcb05440b7e764
- MD5 0d2af18ddbb064134c1faebe5fc833e9
- SHA1 efeb7db618bbf9d4ceebca44912989ecd1baeed1
- SHA512 33c20b115b0fe1c401c620032ed0277fab1068be265f4b1c798fdf85e8af9e294e0a3019f63d58defd7a91817245efe08cd950119d32a3025f5a977ceda5b448
- SSDEEP 196608:uq2Pv9qE2H6RuHh/iGqjeNNeR3UOMhF1c6LUzyjTiZsjKV4wj0lcJ8Eb+:uqSqE2pH5q3Mb1JLE8ksjgxQlDv
- TLSH
  T1D396332CF219A4B1EA7611B24873929F5A2B4F7BCF35925BDEDA13354DBBD601E83004
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 12KB
- SHA256 a75c0c6ffcfe8cf8894d2c644f74cff8da2af0dffab23782fbbb6597c1c7738b
- MD5 80db9f53cb4176c30ab415985c876a86
- SHA1 29a032cf9858b309982bc96910f66c72cc2056fe
- SHA512 8b78a31d507e1641b3cc08007a6bee9db99923178b19047b65448f7143c55074f8219a924ea4690de8625beda1b53c6b8f216734f76c669856f7d256961f77c1
- SSDEEP 192:V1BTusyjbI05hbvNuw8Ykv/RjyE+lJP93/:HyA0DJuw8Ykvtp+lJ13/
- TLSH
  T18F42C618BF4705F7E9B39534409BE7EF451BA520DA2F4E4AEB0A0A09FE77271580E342
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 28KB
- SHA256 b89448b9fd7be5ef215cac6d973a57c0e75e1fffa25552afe174855c9b71fdf9
- MD5 81e34f1c4b04a15dbce200c52f598f67
- SHA1 f40a922ad7a5494e2aeeaa2b961d96738e888af7
- SHA512 577f52a292075269f0e8ec4c6d243b2ed411872e009839553020929a8263174ad97943f150543e4ea6cb327d95e227f4065441a9d2106b7cabf1cb872dbcc181
- SSDEEP 384:xmEs6sVqQq0DwRiGUaLYuAXLaMoy4m973uwYkvZ6YfkzB8yy1Eiu8ILvFd/9:xmEwqZ2wRiGUcY8TBsdvEbB8yyvIJ
- TLSH
  T1DFD20A2AFF06C8F2D1B1D570889EE677C526782957220E7BFF1B9E4CFC236825A19105
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 14KB
- SHA256 778b2bfbf3f4e641161f40c8174442a4d3865f097e3a2a383356dbfcac8005ab
- MD5 2726673c720a296442c8ed134b41d169
- SHA1 b8050c85017fcda78f6b82cc86ad277bb0dbd539
- SHA512 95fd8cd96a4c627dfc1a89a98630ead3fe431360ab15f2324a52fdd03b2b493bdc44a4d6d0189276826725ea4e48aeb4711459a459b92a80be51e9431b70bb0b
- SSDEEP 192:clWWck581HwPRLG/CocFR1w5nEYkv/RGl5BoiS+6SZSM3CU:Hdk5SoRLG/CocFR62Ykv8l5BoiFXyU
- TLSH
  T16252E50EFB0A44F6C572D834548BE72F869DA415C66F4E0AEF170B0CBDA32B5280E346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 33KB
- SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
- MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
- SHA1 75197fee3c6a814fe035788d1c34ead39349b860
- SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
- SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
- TLSH
  T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $TEMP/MicrosoftEdgeWebview2Setup.exe
- Size 1.6MB
- SHA256 0223fa1e8d5bd5e4344fb8734e60d088e79f262c0a24444d01f240bc996f04e5
- MD5 7667d111e1953c8cdeec7a8b1c7396f9
- SHA1 a5598ec1aa6033b34400b3d919ee4e720959b06a
- SHA512 5a54f64e6e1697189fb7f5e5d900823157458722a408942b701ed57cb265cadb7f1766426f62579321fe92eaa7c48864c154986dfaffa4d9d1bb3d2f70d1d295
- SSDEEP 24576:hwiGk63nsDlb3OeGJ5yrkx7gXuahsfAqOKHBRhGuIX6eHhUGotJzYmmX2Nbn:hwiGf3s5iBJ5yrkx7gd8JIKeSfZyQj
- TLSH
  T15575221075D58432F2F30D3089F199B10F3DBD608F72AA9F13461A2E1EB5AE1E636766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence privilege_escalation defense_evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral11 behavioral12
- Target
  WebView2Loader.dll
- Size 156KB
- SHA256 8427b1fc58ec707813e5c0a51eb5d69397bb333250a7b891be4d3b123f1e0f1c
- MD5 b7f10b8066ee96c628e09c439b8d0b9b
- SHA1 3a2fe02d9d43100056b7dd1ccd2dfb3f30ad0f55
- SHA512 4ce26a59faadfa0a20e098caf297f3403ac1542706f72879ed7248dee4026a5c7ffc3aa95912d8e3510ac7593082429ce0e83978a5843cfce52fb475cc975333
- SSDEEP 3072:1mJgy7/ph9euiDNQ6A93jJBC9JGv6T/MEtJ6mj4UrqhQ:w/NVZ6A93j//EtJnrX
- TLSH
  T173F35C5BB2E900BBE17BC278C5A34A15E772B8111760AAEF036447791F137D0AE3DB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  pc-app.exe
- Size 35.3MB
- SHA256 90171af8f88f4fddecff335f97a2d6d78a975856d08f517efb04b479e4bba602
- MD5 298506d9bd380781116133576bf00a9b
- SHA1 7f0b255d827ae535d99f4adb6298436b18382c0a
- SHA512 563485053e852ba24edcdb9a1ca31eb5e4de06e548d5b1d56fe5729a07eba64da9870dd4862eedff79d7a4fb20c3df40206751511014e1835d312999beb65f4e
- SSDEEP 196608:zFLd5Lj9L0ctuns1pTzd5SC8yrAEePEDINasKodrJIf7MrP18SFtK:zrN9gctdACfrAEkEin1rJIf7MrPE
- TLSH
  T1CD877E53B2050C9EC67BD63BC1BB363A7235B35572206B7B1E984E366F166D08B1E318
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral14 behavioral15
- Target
  uninstall.exe
- Size 144KB
- SHA256 8269cf3edbaa1ef9ca308e449e60dae5f3d3722ae47afe8554d6ff009bac4d25
- MD5 65a577d6fb661cb6496154247e37b947
- SHA1 2ca2cee44e3e8d3a8ee7c2e2a6794b07559708cf
- SHA512 320463394c323b8ce2c57cd2d669ab67b067a040886dcf296b3662b2cee8af204fa28787522d59faaf75ad71e4ee9090eee95283acb47d93dfcd9775eecd04d3
- SSDEEP 3072:erv+LsMjvFsOTb98xQT+5U5qwaceAPp4a7eYd+Pyb:OWLsKB0IamPl7V4PW
- TLSH
  T117E3AE1CBB268CF7D832453059D7FAAF4A35AD718A5A970BEB111B37DC33561A60B302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral16 behavioral17
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 8KB
- SHA256 2e08e077a0800ec39c0596f4dd91cbbfa917eeef2d75a00767917b8d1f6884ac
- MD5 313661ec12ed5ce1fd0b3292bf02cb69
- SHA1 fd341676cf680a9f0f690c35b43feadc0693e9a8
- SHA512 a16f35c6019eb1431a3d03fb7d0935c272756f2a8363f541e168a55b2e20a85ee90191715c845ab0588eef8f2af6cf91ac75c5bf1a5d0c61c513339006da9ff2
- SSDEEP 96:b0nLo47eYkrGj23kBTPEa8ir2qUuRkNB/RMZCabEO/2/HdNfdpX2N:KoZYkrGj20tEEeYkv/RaCA/2/9h2N
- TLSH
  T13402D6DEFF0959F5C83395344096F25FC51D7426CA3B0E46EE1B0629BA2A9FC2A0D206
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18 behavioral19
- Target
  $PLUGINSDIR/System.dll
- Size 28KB
- SHA256 b89448b9fd7be5ef215cac6d973a57c0e75e1fffa25552afe174855c9b71fdf9
- MD5 81e34f1c4b04a15dbce200c52f598f67
- SHA1 f40a922ad7a5494e2aeeaa2b961d96738e888af7
- SHA512 577f52a292075269f0e8ec4c6d243b2ed411872e009839553020929a8263174ad97943f150543e4ea6cb327d95e227f4065441a9d2106b7cabf1cb872dbcc181
- SSDEEP 384:xmEs6sVqQq0DwRiGUaLYuAXLaMoy4m973uwYkvZ6YfkzB8yy1Eiu8ILvFd/9:xmEwqZ2wRiGUcY8TBsdvEbB8yyvIJ
- TLSH
  T1DFD20A2AFF06C8F2D1B1D570889EE677C526782957220E7BFF1B9E4CFC236825A19105
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20 behavioral21
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 33KB
- SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
- MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
- SHA1 75197fee3c6a814fe035788d1c34ead39349b860
- SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
- SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
- TLSH
  T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22 behavioral23

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Checks installed software on the system

Event Triggered Execution: Image File Execution Options Injection

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Checks whether UAC is enabled

Network Share Discovery

Deletes itself

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23