c329bb8db9a414b718dcc4d1dd43f63c68c829d2518bfdc7e121462fff7c5a1c

General

Target
人員削減対象者リスト.zip
Size 872KB
Sample260806-zpw52a1alg
SHA256 c329bb8db9a414b718dcc4d1dd43f63c68c829d2518bfdc7e121462fff7c5a1c
MD5 34ce7162842a41e88d0ebf2f77a80c73
SHA1 d747eab65858e47bbf905c5df9024d98e1f8e0fa
SHA512 7a6d3bada89b06c3adc2e5af8988a0c4553e15591a8dcb10d451109f7c67d94bbcb816b50c37ccd1af44488866ead54c86386c7f03ad5fd667c94f79e30c8b1b
SSDEEP 24576:NaadhFjlyXjNL6pwBH92zq5OitzVmZIM+N:5FByXo+92z0VmZI
TLSH
T1541533A4D3445708EA24B8EB82104BE8577FEE23B52EFC2789E25781863C07D57B49D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion ransomware

Malware Config

Targets

- Target
  conf.ini
- Size 728KB
- SHA256 9147feb892858d2b22ea9966989f644633e8a063f73b6063b6c20f6f2e12b58a
- MD5 307a962dee7c2b1f502eacb1850ca57a
- SHA1 21d564f3807b32d351077607a49b033c9a0f44ea
- SHA512 18d8907f275d738bab7e3191e5b902ce159eeee457e2c96670d0a8a4ac4b012d05e8f90179c3ea016a9f49af9dde8e8a9a292defb41ff449efd624eda21e1551
- SSDEEP 12288:BEVX1lGVXthtcf47mqIR5L9EzdW+Lh5DSwxuCpcYpZLx9V8qrSqVjyGjFm+ZzHzp:BGllUXtDi5LAWYDSQmYzLFlOqVGGhzHF
- TLSH
  T12CF4F124A5B18F7C9E2377DCA14984E59CAFD8EE77C940C92BB0D2F248605F8541EF1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral1 behavioral2
- Target
  perfctrl.dll
- Size 321KB
- SHA256 bba88ccd6b122f533e1362e88090aa5c7a5c9815e5589d288c90cf0912b33ee4
- MD5 3f164203f76c892baa6fb51f436c1656
- SHA1 daf9195a7bc00be8301e7dc98eaf718737098af9
- SHA512 6557cadf8926200db9a5e8330a3d3c747b0e159f935247f5dd379aef7005bcac1023f65ef79beb4e5bf252f169f76ab0de0cd37691b3372f38dc6aea569ee661
- SSDEEP 6144:2wDn2lcBQhmbmI2Me8/7Bs0cWArIh+1g1t7dCngzMu4hH/3MPIXr/:rUcBGumI27uBnfArL1s7zYsS
- TLSH
  T10D649C2EA9210CB1C9364934EBEB0F0FBBF65D54CCD4635D3B212969BEDB3A9C021915
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
behavioral3 behavioral4
- Target
  人員削減対象者リスト.exe
- Size 190KB
- SHA256 cc9a16f5a122e183fc5b1f4a8802fd9267120502e159833dc4f7901323cae20d
- MD5 fbca8c32d5efce633dfc440157850f57
- SHA1 a826e6ac62aae6fa394d21b9068981bbff0c0630
- SHA512 34792d3182ed7184e65f65846615384e1d607255546356beba9d3aee3e47ca93341e586aa7cbd03ec595f55e696b8eecd8aade7ecb93a7f1566842fe35824ed2
- SSDEEP 3072:mqiCgiZCAPJWM/SP1vEwQlto8qFphi+p+Kagdy5SYxk4a7YcOT:U0CAxWM/SP1vEwQlto8qFpQiuS4
- TLSH
  T12A14B51667F921A5F5B3AA7489B50605EA73B8616B30D6DF4294C23D0F33AD4BC34F22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
behavioral5

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

4

T1497

Credential Access

Discovery

Query Registry

4

T1012

Virtualization/Sandbox Evasion

4

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates VirtualBox registry keys

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Identifies Wine through registry keys

Enumerates VirtualBox registry keys

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Identifies Wine through registry keys

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5