aa47f5fb44a1d5015cb37add6c7a4b7249081e7e039c2f08dfc366f3f047d88e

Sharing

Copy URL Twitter E-mail

General

Target
HoI4-DLC-Tool.zip
Size 123.6MB
Sample260804-s66bpshp4v
SHA256 aa47f5fb44a1d5015cb37add6c7a4b7249081e7e039c2f08dfc366f3f047d88e
MD5 146a356e73007cd191b387f1bbdc3501
SHA1 a64257ca3596424d6086ad0144eff9032287bcea
SHA512 e47717e239fcf116dee521d76d3af56bd4e4f57dd55905796aa1186c04e66f7ec061dc0056415ec37132e3dfd05e8c620bcd8dfb4f87673cc1cd6409bfedb6d2
SSDEEP 3145728:t0Myb2i3C6wv5hGKt8T/j0YzU9IE59iVWptVAaQIeDHk:28i3ixv+T/j0V9l9j1AaFMk
TLSH
T1AD583350507327BEF442647775AAC43F2F5AC628599CC8D1F68903C4FA26AE58F72CB8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  CreamAPI.msi
- Size 19.4MB
- SHA256 fb47fca048699098ecd790a9fa23c732aa5e140bdfdbf3de5be87049cce2989a
- MD5 b258a8396adcce6bbbf51a57af510b71
- SHA1 351938719ea2ef662ecb28b8e255dbed96f54145
- SHA512 d8f5a5fbc7ae218e4f1c579b7c93feb9aec3826da7234f584a6493f2c43dc966f6766c0f734d0a031c2b40e68802db2fadeff90f914a3dc23aebfdafc8af9969
- SSDEEP 393216:X/0AS3glvSv87upu4GCAKUdOCu3et1Ne0sxqJZiU:X9pa069A7dhIehJcU
- TLSH
  T1AE2733A668222E83CA5466BB23431342BF310DB33B1287552D39F92D1CBD1FA5B5D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution persistence privilege_escalation ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  coreclr.dll
- Size 4.6MB
- SHA256 c01bab84e8bf5f2112eaa437e044d96d9560b5654dac3c3a131f397172147e7f
- MD5 5111542aa1b5d22b93bd35d8992f8d63
- SHA1 d14a629250f642d136fdab7468397564ed28139b
- SHA512 d901c895daae97c38203816131bb9d295ce771adee9142a2f6adb3a41aa489f0a67cb136b8e6dfe56632ede87e4606c739ecf33a520d133d9e5eaeda80eec776
- SSDEEP 98304:EgE6vzfrdxrZnKcVJxKYNWs4CXcs0t43nH:EgDnKPnxCsk
- TLSH
  T1D6269E2AB6BD00D8C4BAC078C5D74A17FAB278551338DBEF46648AA11F277E16B3D311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  test/dump_stack.elf
- Size 135KB
- SHA256 8a19d679fc8efed58e7c2744d9d2c37b459db5ee996695d9d41669ff820847f4
- MD5 31c9136cd34e9f8452cec1d8a70a7385
- SHA1 91096f6991441b0e7f30ddd3e693f98e9be9ef6f
- SHA512 c643cf14a7d702c272db6086a0c52c6af7593c347f44c7497f9a012e5375a025c2dff9223083002d47e61b9d55dcf76eb2655564702ef3ea74a26095a3e4339e
- SSDEEP 3072:LBC8SmXxtpj7AUsJp5ndcdg3DuKnX0LZmer4:LBjSmDpfAZHdcdg3SKX0LZ54
- TLSH
  T164D339423A99150BF0630DF4377E2FF8EB5E8BE115B78959600DAA8C17718F6064FE98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  test/gs_gcm_basic_triangle.elf
- Size 202KB
- SHA256 7797dd3ca95dfc80c2d35e3bbab34fe466bc46b16f2c8434117dff9426d13a96
- MD5 731dba66ae6bc38cb6e1b49de66a0620
- SHA1 4c3130f957317f5914e84433ec3bfab646ced852
- SHA512 2abe5990ee3f123266e0373bd3d0d0a1c9b5f1c39a7cc78c76ead9dd9476f9c4da118c6e85b70b08e0770a1cca639f2c766dda254c3f9e710e74c176c8f803e9
- SSDEEP 3072:R8jHA9C464bS109D70Wsqiqn+glmONKn5Wp0LZm:GbA9Cn4809/0I3+glm+K5O0LZ
- TLSH
  T18E1409013B980E4BE4530FB03B7F2BF8CB9D4A9515B7AA4D601EAA4C177097B054FB99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11 behavioral12 behavioral9
- Target
  test/gs_gcm_cube.elf
- Size 348KB
- SHA256 e32d94f9dcb3e72d71b7cf9cc3f34d71e9b868e37ca85655e66fb6fc0d59e9a0
- MD5 ad730c7617191a6291cdc06877c01b8c
- SHA1 26fbb08c4a14903f6f16ee2b3e8cbffa23e64adb
- SHA512 d5b020f371ce9526761e9cd62042d74d53ff6d9a91423acf267dc8905bbbef6f2a8e166059ec1640f17e6e3e79312f66610320a05bef8dba9bee3bbb8a3a7317
- SSDEEP 6144:PJHbPFxWTlypRkrs57dLDErOZXe3/RDGnG7pMBl9OWy:NcwpoDV/RDEr
- TLSH
  T1AC741741363CC543C09A1670ACBFDBEC4F907E52DF659A8BB0C8B78F61715A8392A791
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14 behavioral15 behavioral16
- Target
  test/gs_gcm_handle_system_cmd.elf
- Size 268KB
- SHA256 88f416741db8d617a5e8fbce43754afc150e43451b42d002e6ad51e91cdf6de2
- MD5 1e6b83b7652ff9a6a4686222798e85ec
- SHA1 3cfcf58a9813a43e372fb8d7331ee6a7eae2cda4
- SHA512 622512e2b49664faf9c6310674cccb06b8c807e4fe40a075af796888e0a5a9af35212703a9c1366aea41af28da3dad57169e6734b7d5b06da9b4ba2be81b9413
- SSDEEP 1536:Hoqwygqbb8x8OvrCC964S42kvGDNAmnhmp8XN7BjsSG0WLtzsoZLWaWvuiP:Hombc64veBXhmpO7BjsbB3Wvu
- TLSH
  T1DA44F4207614C947E05A5A303D6FDFFC9B647E61CCBA924B30C8BB2F7731665081EA95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18 behavioral19 behavioral20
- Target
  test/gs_gcm_hello_world.elf
- Size 334KB
- SHA256 0760fd741d0ba7fe7f6d20a901912b60e4f8e74d5cebc84f9a48c2a74b616617
- MD5 27f56fd0a6c44113826951145f9a56e6
- SHA1 6e135ba731bed6455331637339c6472b1020a78c
- SHA512 61ea51ae132689c47d138b5c4071f4328eb599b6f66314a0e660854d612cef8d16aafe0c69b932785caddd7818e30f6186f064f88b29401496e5f1c0c20e628b
- SSDEEP 6144:2b47nJ8ORusLGHXaWeQnTLPmRatW77X4/OWH:LuKu7TmRap
- TLSH
  T10A742900363CC543C09A1630AD6ADBEC4BA47E51DF6AAF8BB4C8B7EF217159C391A754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22 behavioral23 behavioral24
- Target
  test/gs_gcm_tetris.elf
- Size 535KB
- SHA256 2a564792c578b73afaf394f9cfea5b470b468dd20c15b83185cf8bbe348e8e99
- MD5 6b1f93137ba853389fda961a0fe1a5a9
- SHA1 fa0b1b2c0e8986464e9753762f7ccaf315e9ab08
- SHA512 e6875e41bb9a0cd365346adbe86e3eae4be8fbfd6fe62a03b166eda250f64926f3c12a6cf3b535d3fb8ffe17078a68a89dcd5055ea11f3f46f0c41ee983961e5
- SSDEEP 6144:sCL2Mb7OhUl1d+OmpqN75OyYir/kKfj8tl4iLnDemsqlB6bKe8uIwwJhbg74I/25:ZqXoQkNVWKLanjlB6aBwegVFlnnthjb
- TLSH
  T120C45B023BEA4997E4260EB0B6BF1FF5CF0D83B554B32A8D241A674C0BB1955349B3D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26 behavioral27 behavioral28
- Target
  test/pad_test.elf
- Size 135KB
- SHA256 bc3c23b521f40f19f40d2cd33c8c6a61edc7cf730d1c31827902eb13907640eb
- MD5 606d9fbb89700cb1dd0434ac0cfc34bf
- SHA1 b10d5519cb5eb2580d398be5e511e2442e547817
- SHA512 bddd54e0ac52244e44d55ea6b5df38854e2b19a9dda126b450de0e608349a6abfd37a3ed7d7c094eb49f92d570b918d3715489124d23a4d09e4a05741e6efc96
- SSDEEP 3072:TmeaispEtE7AMsBxJnNcFofTKKnQ0LZj:TmBiDteAp/NcFofuKQ0LZj
- TLSH
  T1EAD34A023BAD190BF4534DB0377F2FF9CB5E8BE125B74959600DAA8C17718E6064BE98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30 behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Badlisted process makes network request

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32