72ffe8859eaa63637f5a62b7c454241db35938f8326f6ccf20352e00f8df2fe5

Sharing

Copy URL Twitter E-mail

General

Target
Un_A.exe
Size 155KB
Sample260804-e7apja1fqa
SHA256 72ffe8859eaa63637f5a62b7c454241db35938f8326f6ccf20352e00f8df2fe5
MD5 32109e2aac377fa07b849f4f4033edc5
SHA1 a7b87a221744fb2e36327be0a34c17b7d734c47f
SHA512 688d9b51060d84c4e2dd0ddbb20d43bbc8bf93a903f26e855f546335bd7a5c9ef5c6f888dff35d379cbb1d782c5e231b33831b7272cde2b40c2d7fc2b85ffc0d
SSDEEP 3072:iIAe+3aJpgWXTBuq/JFONM2cZ6iKowuq12ApG3s/6:izB+pgURJFOS21iQ5i+6
TLSH
T1EEF36B0167E4D12EF9E34B70E8E286F65735BC55E5228E9F77847F1E3834200AE493A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Un_A.exe
- Size 155KB
- SHA256 72ffe8859eaa63637f5a62b7c454241db35938f8326f6ccf20352e00f8df2fe5
- MD5 32109e2aac377fa07b849f4f4033edc5
- SHA1 a7b87a221744fb2e36327be0a34c17b7d734c47f
- SHA512 688d9b51060d84c4e2dd0ddbb20d43bbc8bf93a903f26e855f546335bd7a5c9ef5c6f888dff35d379cbb1d782c5e231b33831b7272cde2b40c2d7fc2b85ffc0d
- SSDEEP 3072:iIAe+3aJpgWXTBuq/JFONM2cZ6iKowuq12ApG3s/6:izB+pgURJFOS21iQ5i+6
- TLSH
  T1EEF36B0167E4D12EF9E34B70E8E286F65735BC55E5228E9F77847F1E3834200AE493A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 16KB
- SHA256 4fca692a36f0c99e26b5bc7ef9db5269d2c1e21288184953898130fea9b1c4fc
- MD5 46ba3881f8b27f54a8d92d600e61ee7b
- SHA1 15933b6ece85a6d45fd78ae499b445a3bc6d2d05
- SHA512 6f64d3cb4634ed51710f578667b92a429aa871a0a141092df3cf7e0134a0b145f802f91126f1ce43ddb4b9d6cc6fb875c9acec22eab0cec86a72dd916e1f9eb3
- SSDEEP 384:kTrZBV86AQINyQH38E9VF6IYinAM+oZtfpMVK:kXZL86A1MEpYinAMxZ5aK
- TLSH
  T12E725BB286805C15CE4B8D3274D5A537AA727B926BC0C1D7136AC1518B907C37FFC2EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/ShellLink.dll
- Size 15KB
- SHA256 eae7829a3df5d8d63e16787f7c3d5ae4b82b3b79c2cd7aad9c2532374b6ea522
- MD5 130e29fa7dc68393d3ef12fa5fe876b9
- SHA1 54d3b821df8f42e26698f0cf99bca5d2e6aa080e
- SHA512 56dbae0e1918ed50c99a863304544d5d31925c62d4ebfd7244d67f909c353ee4160b081b43832cf33f1048f998431ba14270600de512dc6c853a17dd524df317
- SSDEEP 384:Ld7JQGYNyQH38E9VF6IYinAM+oZiDzQ06:LgVMEpYinAMxZqzB6
- TLSH
  T187724C638B75EC51CC0FCD3674C4B9369A71AB8615E0C5DA1389C6904B9238B3FF91B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  $PLUGINSDIR/modern-header.bmp
- Size 25KB
- SHA256 d93b76d51bd2214fa6e999c1bf70b4aff5165a6542f9b9b2a92b5672601f4624
- MD5 da3486d12bb4c8aec16bd9e0d363d23f
- SHA1 863244a4845c9d5dea8dd36e1083f5639e1224e1
- SHA512 8e40adb65a4ad46f3bc5920d7fd8294397268e754b1eb00d4f7b0883be6468448033d9a46cf3a00fccddb4a7c81e7f984cf5a25731532c1aeface69573dfe59f
- SSDEEP 96:iAwofR7VVNRn5/7hY0buGRGGM/o3FYsIR:YWxvN//7a0buGRGGTdm
- TLSH
  T181C2D8AEB932992ECC9811B41154E7FD8B303C5C7940626A31DFFCCF0EB31CA2169842
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsExec.dll
- Size 17KB
- SHA256 3e2399ae5ce16dd69f7e2c71d928cf54a1024afced8155f1fd663a3e123d9226
- MD5 2095af18c696968208315d4328a2b7fe
- SHA1 b1b0e70c03724b2941e92c5098cc1fc0f2b51568
- SHA512 60105dfb1cd60b4048bd7b367969f36ed6bd29f92488ba8cfa862e31942fd529cbc58e8b0c738d91d8bef07c5902ce334e36c66eae1bfe104b44a159b5615ae5
- SSDEEP 384:PbGgezxEqoyGgmkNFNyQH38E9VF6IYinAM+oZhc3iMy8:T31yGLkbMEpYinAMxZAy8
- TLSH
  T1DE826CB749802C66CD4F8D7039D4A83A5BB9BA531BE0C1D2535BC2518B917C2FFE82A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10