e114264ea0d82760782d980212fe5b82949111ebb2417abdb6a770c8ca59be1b

General

Target
Архив WinRAR (2).rar
Size 109KB
Sample260804-czcg2sep2x
SHA256 e114264ea0d82760782d980212fe5b82949111ebb2417abdb6a770c8ca59be1b
MD5 3dbf405736a1e37fb1d5f591acace002
SHA1 3f8c49abc045659522fdf4f880db853b1f9245ab
SHA512 7c8470420480d614ef48f7fec4d7ed9e99608c39e86ff2b6eba65e2e66020f109816f91ffb54a106d908fd43701b0ba53966f88cce46e34d7a7b3c03f3a528f1
SSDEEP 3072:8xT+Bq9ER9qBuLrMHDBHSkIfdXMhbdt7h:wwiER9X+DtSvdXMhbd9h
TLSH
T198B312C885C3B2801AEF2745C67EF94326516EF6E57B6A84D26C634EC73C681B0E48F5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  9 емтихан тап (1).docx
- Size 135KB
- SHA256 339c02c6df9b2b7a7febb329a6d45bbcc51d4970c2a89dfb3a66cad42a288bd0
- MD5 2a6ea1c3a350ac70a1718aa78eda6b68
- SHA1 dbe2f34c0d13eebec5f7ffc6dab52bdb82f90127
- SHA512 dc0a9d1f913b28fb1088bf3371345eb029c1936622cfd451fec06ae42ee92edfbfc737b3f803005043e59e5f96140bc16bbac096e0c973236ff8aad812e35f06
- SSDEEP 1536:Y+j1KkI+5P90xNtyaXJoFY1QZbN3rtGoXQt1lDo5Tjh1ebNaSkOYuMXJ+JFqrOWa:TKZ+b0bvXJ91Q9M4tgofu6kLnZh
- TLSH
  T14FD3BE7B8841E7E4E6B911F626179F6C21137F18A884CCA751039CDF3CB16A988CD79E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  vsthemes-org_12384-hatsune-miku-winter.theme.css
- Size 3KB
- SHA256 f1e2416014c6a4e3b32f5cbe8f3e126f94c549fe13a2ae2b3d34ef4caa2076e4
- MD5 27cd7f1b0b5eac765d2ab166a915b198
- SHA1 94d35fd60c1ed3961cc4dec4ebe57eb4f2d17c10
- SHA512 3b64b341c38c1db4adfb5c4d9fe5765588a71f3b3f7a02e8238ba1224482aa04eb7c6317eb390b841a50865a3e03d662478b9a79d5715b9c495569a04d97795e
- TLSH
  T16B6132E3FF50491EBB578BD230846114E2F6815E98C2919D8CFE6035CCA02EE8577E27
- MD5 SHA1 SHA512 TLSH
Score

10^/10

discovery execution persistence privilege_escalation ransomware
- Suspicious use of NtCreateProcessExOtherParentProcess
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral3 behavioral4
- Target
  vsthemes-org_35871-vokalojd-hatsune-miku.theme.css
- Size 935B
- SHA256 18f4ec003376e1e0fac75f88965f064aa7a455b26fa2db0f90f21b35c84dd92d
- MD5 70c167be737ad267d0c4a033755d60e4
- SHA1 dd97ce5d9eb95683d65673e0b3857347279c7e84
- SHA512 a596cca3ff565a69227591e7ad27639ba44849113417d5d4d1032cb36b86f0441bb6dcd5a9b49943f2a4cd9cd4e4eb63d704696820341a2f5a1e8cc4a23b49e8
- TLSH
  T1A111DCD3E4861468277209D377C0D607B63D620FDD4BFE69F5F8449CDF098B96A02962
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral5 behavioral6