af31149f2cf96b17b3f66813034dc4b2d5dc30b51731cb1b7a4962fd9617431a

Sharing

Copy URL Twitter E-mail

General

Target
af31149f2cf96b17b3f66813034dc4b2d5dc30b51731cb1b7a4962fd9617431a
Size 1.5MB
Sample260806-m7treayhrf
SHA256 af31149f2cf96b17b3f66813034dc4b2d5dc30b51731cb1b7a4962fd9617431a
MD5 19ba0966ab5e159842d6a027f83cd5e1
SHA1 7fa28ad486133569b41fa6d562bb53ecc025f833
SHA512 1353ec0b20fc494b69861a6a32109009c3d232643199ea63f4c994ac92693f7d1616a126d365b71cc57547988731922b93442c45eb25871fbfff94fe27aa8db7
SSDEEP 49152:PkwP/vIgic7qJcT00b6/KLHjU1yeHFH1ZUCD85ORh:cgvIgicJwy6yLDMyGDZUCRh
TLSH
T15E753356070A8A83C1DFC1B23CC2238CD855E7F4D3D7BEA056E669C991AE7C5CA143DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  WinNTSetup/Diskpart/UEFI.txt
- Size 1KB
- SHA256 7528de99315f8a092d5fbe2f994b0386be6180e830050834092108cd66d1b122
- MD5 0878e4b7937bebda3e7efd8c9c34e216
- SHA1 4f47b3f2af35ab2ad610e49baef88329626080ad
- SHA512 cf2d7b3daee7cbb360ab797eeae2a977a5bac9712bc696bd229c5cf47d2bba5285648cb6451874f7def77b509c1db1ce96b078c1a513396297e753bff006d1ed
- TLSH
  T13131BE16A2D21636CD63851311BD7074BAB034508AE2905CF86FC2DEF326F78C26EB68
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  WinNTSetup/Tools/imdisk/cpl/amd64/imdisk.cpl
- Size 113KB
- SHA256 eb5b467f230bb85a74620a52f139cc35772e89ea9b8ffa2a64e10f878aa7b417
- MD5 a19a0f76956805a157281a3998f06a29
- SHA1 eb2e8fece8f2ffd2ef605a000fdbfe46bc97067a
- SHA512 5f4a013e28fdb2b67883144772afd717813d96f84d9eb680ad016fd78d0d8cc8061b5dd78d07238fd648c62dd1b09a8a0a752575a826bc1c96cdded84635f9db
- SSDEEP 3072:yQzTkHAMuaNaGnkuXOfJX928aTCbIrNZgN8IKm7kZtt9Ettt:4AR/GnkoyJX88YKIr/grKkkZtt9Ettt
- TLSH
  T18EB3C602E3E54298E5B6AA705AF50235AAB1BC446F35D7CF0150BD0E3E71EC18C7A76B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  WinNTSetup/Tools/imdisk/sys/amd64/imdisk.sys
- Size 47KB
- SHA256 6702202220268787e361f5a82dae53362c8e6c6dcd240bb01b44dd77ae0788da
- MD5 85e0e6a2e0ff7c2ea46a0ebc9af0e628
- SHA1 66fac892b0c1f5104c3e5da09cfba64236e3b017
- SHA512 1f3644cc0f00c62005a26cc5d2e6bc5d21806770f9dd43933cc5e77a4b32c39f3ee88d15ca588155e82d2c3ae3f0d274e5890c13d9a2a32be992d90026d6be8c
- SSDEEP 768:CuWLlETh9IlP49QX6C431Z7XLDIwsGT82Lq9KPikQ:xaEtm9X6vfXsP2L0eikQ
- TLSH
  T1B5236C83E1A941CDD9AAC1B6C7E946B7EB31B80467751ACF489087256F12FE0EB3C315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  WinNTSetup/Tools/nativevhdboot_x64.dll
- Size 1KB
- SHA256 9e533d246c17994339660a273d3ebcf7db532f440c089cd4f8e103a4d2ac74d9
- MD5 893c137479848a119677a251c390c63b
- SHA1 a72017ba34c83c76fa039c1a354182fe946fd6a5
- SHA512 e6638220ad7413b447d47fc6b571f63bb0feebff9bf37bb204750b191e3988f549c9ef2b8c7c11eb248067f00e42cf9ef1145599ae2443f25cd26a40366ddcb3
- TLSH
  T18E31C22120D5C1EAD15CE574067B2C14B592752047B2FB493A5844B72A32AF8CF6AB1D
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  WinNTSetup/Tools/nativevhdboot_x86.dll
- Size 1KB
- SHA256 7319eaa311a8a808f0af09be14ef24182c3fe4ea80e5f84145f4a3829b37d98b
- MD5 2090bd824412787b0dfdaf045857941a
- SHA1 95b066d61531d1f6f4404fdb56d5a70303fc8099
- SHA512 078684c645b9818c28be6ce15bcb00d3454b01c7995faa1532eef4c247425e66ba43bd79b4df850364c6ccb04146937032af1a3e92bd1f43ce447eb89ec05076
- TLSH
  T17B318B4EEAE041BEC819217806A38BAA3FB03E0116D0D63736397F3A2DAD1B51D61312
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  WinNTSetup/Tools/x64/BootICE/BOOTICEx64.exe
- Size 489KB
- SHA256 e1cb831ac9213b52066f934ba0fa80ea8a9de48932452d4142fa085a2ba24fc2
- MD5 7ddd108c095016b0e2e8d6b5b04f93b8
- SHA1 3764d75c02c8ce8d2c78203aa9eb7f8018a112e1
- SHA512 36c77eaafed04eb3a337a909a90d4c3eb66e1d36531c6248095906332ea6d03dffc9abd7fbcb3c2101065110e4536c0a89b6320dcab386871b3f9d9e34e40bad
- SSDEEP 6144:4v/DcaTr3TNUkgs01v610dZlfLw8Not8jfCHGSLs/u3fvItKDm1bVcYGz9qA/8qI:k/DfGVBcXfHGSQ6nwUm1q5z9l8M
- TLSH
  T138B401217E4D96A4C10804744C96DE242272AC22F81A7B1B63DFF74FF97A331DC2D699
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

upx
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral11 behavioral12
- Target
  WinNTSetup/Tools/x64/MSSTMake.exe
- Size 114KB
- SHA256 360fdca4daeb6ada1f76b8940af9d509624ace6db03d1a735b2e393c6d2b4cf1
- MD5 64d41e1e1a0410bf669c1d0820ed4c1f
- SHA1 c5e9017f725df051a620d6e565b14e994549f6c6
- SHA512 4c5dfcd8b42f095749d00bfbec2c7c84f9bbaa6a8cb13891d1c7ccb70cfbffa418eb849e64f0c85129eac55a467af39b07d2381cdb98678dcc1dc0e580305500
- SSDEEP 3072:swvKErKi7TeSS2wpdhBMo/VRCMIB9dWIA5TO7Agyh:sWrKITRStDhqcVPIxWIA0A/
- TLSH
  T176B33916A7A560F9D863C570CDB3A623B73038699378A3EF47546E260F323909D3D369
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  WinNTSetup/Tools/x64/WIMHost.exe
- Size 88KB
- SHA256 7320b23d0143f2727074f413c3bff7f78ad43f8b5f8593fae3b1373ad17bbf09
- MD5 abb6ef6b02381d752191258a1fa08d81
- SHA1 65c2794551c0b478649bbc1ecedfb489292153ae
- SHA512 1eef297b078a1b039b53aaa236cb638ff7dc20f7b90650d4be5e72a248a40cee43c9bc84e12b0b8c7ea1946c3b4c474739178ccc14fcc0639394d4355247b4c2
- SSDEEP 1536:IjyiyB9p853bTbogk74LOIN8zl82fC4jpJKv:IjDSp2nboN4iy858gHKv
- TLSH
  T1FE93F742A2A6B0BCD52AC17553666471BA71F4855B327EEF4360C7301FA6EC07E38F29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  WinNTSetup/Tools/x64/offreg.dll
- Size 117KB
- SHA256 6ff59490887dfa4ad0589a64adc539ee87366be2e85705397b83487e5d0bbd9f
- MD5 c01eaffb542126a5a702cadc03d5c8e9
- SHA1 1607d40e49d04e243ce79b2aaf7f2fe8bcdf288c
- SHA512 7f65f208a1ec9ba4020d1d68b9586fc79f478b98675030f644c3a9beb67881991e8cee723d458b5011e83d68186f7f32b03ff1e4d97c35145b56a1a003678974
- SSDEEP 1536:O2ctxyL6tEFjp7uSO/39Zn2izA9qLUEsIg26QnFMoa58zi:O2wx66I97uSu9Z2is8Y2TXe8O
- TLSH
  T14EC39E1E73B821B6E4668278C459430BE776B16623249BDF02E0CA7D5F13BD6AE3C741
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  WinNTSetup/Tools/x64/wimlib.dll
- Size 481KB
- SHA256 dd19c49b8143b8b3910c5ef1d430dcae8bab2197094fff5b96bd5844aa5046c4
- MD5 834db85f8cadc30f8de15a3676f9faa3
- SHA1 67d59e47bb56ec69a391d39dcfbfba2bec2ae1a5
- SHA512 9989aae6223c8dc52a1eb5296bcccfea1de2ab59a90ab8cfa1492d8e6e18368b9a3a09e8267a3ee4f4d54e26ac537bea47722cca7314fbb5e137edcae4cf2666
- SSDEEP 6144:5Z2P2tYqmBaY6u0AMcusIrxmIlbQCDBXyVtDSPKbMsjsss:5ZXtVPAMcl2PbBXOq1
- TLSH
  T119A44B06E3F6516CF2F7E6305A7A5672A9337C155530EE6E1248C67D2F33E40CA28B26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  WinNTSetup/Tools/x64/wimlib/libwim-15.dll
- Size 486KB
- SHA256 ba853ee1e3fc5f5798581f02e8e066ba07a0a2375f0bf444fe981431fd508495
- MD5 db1ef5ed32577db5433ce471ffb4b531
- SHA1 32baffa86cd54fe25d09ba937ee71094b55af7c8
- SHA512 99115190b1ed4cd32986ad1cb8778573b33d6b0d092d90a4ebd070ec0d123f4105bf66c07a389e2a0fcee1816f0fac1250c5f36030c9e3865c5f29b53482df13
- SSDEEP 6144:zC3LLufFLXCHlKyTgOSFuhLTmpkOLNw73ErtrZtkJGM2XbBz:zC3LafFLXdyUO9LT9gW7ErFZMGMa
- TLSH
  T103B43B02E3F311BCF2B7D6305A779A7269337C515830EE7E4198C6792E72E508A25B36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  WinNTSetup/Unattend/无人值守/跳过你的数据将在你所在的国家或地区之外进行处理.cmd
- Size 2KB
- SHA256 0f557d1136325720f087de4d2b65ed911a06636dc019881cf2d5f975cfb5ad48
- MD5 2f45a9b44471d84b18aea31f2af8ce75
- SHA1 f4a14ce2d9b5db99e45450b81444095d440816d0
- SHA512 27db6fe789ab21c7a3cd98e9e226d01abad7136e48d4c81488f8e7b6f7d91aea8a37b47db9d5139dfea25d2e5647b344b02673710d5c7f5885f1331146d8eddb
- TLSH
  T1E0512E143024083A4535FE61CE6B5393F339688705010A8E3E9E95B02F72CEA6BFA6C9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  WinNTSetup/WinNTSetup_x64.exe
- Size 1.0MB
- SHA256 5236a34ab904d14ec4b0d37b89f584756f16caf70f1b6296e1020ba8f6b0de4b
- MD5 ac12027e637978a927c436909a508226
- SHA1 84c961a99b4dcc71477746a347721261a27d4f13
- SHA512 87c083273349b99a3d0bcd8f51892a4161f3980f369cd9502808c9353b9f353ae69978866170b5c1b573c12ff9d6e0bd78f47444a48128c0d01a45203e84ffb5
- SSDEEP 24576:vnswxOPG3vs4hfOlCH2Tp1WkRbRNOGLF:vsR+fVhfOlC0p1Wk11L
- TLSH
  T1C9356B0BB2E9015CE07AD2B5572A5122FAF3BC446E31FE9F42605A151FB2F50A73D70A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Enumerates connected drives

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25