69712bfa09591b4cba699aad04fdffc50236a6dbe0fc356695262a753aa1d5e6

Sharing

Copy URL Twitter E-mail

General

Target
69712bfa09591b4cba699aad04fdffc50236a6dbe0fc356695262a753aa1d5e6
Size 12.0MB
Sample260807-cnhjxswblh
SHA256 69712bfa09591b4cba699aad04fdffc50236a6dbe0fc356695262a753aa1d5e6
MD5 570bdb58812de5eba28fe402a45823c5
SHA1 8a53b40161da24f1f8c621707344a065638e6417
SHA512 9e0da6cc0435b46bca370f7664f67c6fd4f9d21e7d186ef078514dd2f9d58e14400316dea40286df7ad9be9026f53fe2de1124ffabdb2e13ce359acb21886bfa
SSDEEP 196608:h/0dKRx4OIB3bi3w2/OXvX8PCdxQMxK3elQ5NdIvw0uMzqh+r8jDZ2tjvYsGdvrs:h5i7efcX86UQK3WQKFuMzqUIxkjvhG1s
TLSH
T112C633EE74E26C28C07649343E1D364046E7E2882ED4B93D28AB1C0754B7A974F657EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  tweek/GAMELOOP 4.4LAG FIX/.bat/10 Desabilitar Mitigations.cmd
- Size 222B
- SHA256 80bcc1324126a2f343a3017ed9dca60cfd90d595cc6da1f1ebd05b0a30fad873
- MD5 11f1ffb2d1c6209392e2426beef33e26
- SHA1 0900d6a691144ed0c1489b36abd589380616c793
- SHA512 891cee9743b84ff0f2e0776628ca3d85585603267bd0b447136cbf7bee8068421f5d87f35042d80d5c3e7ea4c9c192c3dfa120c4a122b5e16c90d4e60f4dad87
- TLSH
  T108D0972132C82C925187CC6152B992732EDC00480033097224A5850BAA2B8709B59B4A
- MD5 SHA1 SHA512 TLSH
Score

6^/10

defense_evasion execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  tweek/GAMELOOP 4.4LAG FIX/.bat/BCD Edit.cmd
- Size 1019B
- SHA256 352ee932859eb35787df8ac9f929257869eb979c876ff837e70527601b717631
- MD5 9c4468c4082b37b5a256df0b6d6ea98f
- SHA1 9c3e6150a89f9daf539a9006e70aefb142a7176c
- SHA512 73049d5feb33de664ff53ec4dc0661f6f367b699c54c8b66300fdba228bfe0f902731d340f9ab8d1e3a5ab8912df92361f88e189cc45155f45851b435aabe3c0
- TLSH
  T13A118E2A75517DB60152D81AFE7CA1407A35C40799E5ACF8B017A0F854EA28CDA7CF7C
- MD5 SHA1 SHA512 TLSH
Score

9^/10

execution
- Modifies boot configuration data using bcdedit
behavioral3 behavioral4
- Target
  tweek/GAMELOOP 4.4LAG FIX/.bat/BCD Tweaks.cmd
- Size 657B
- SHA256 434a53a192749953cfe77a25327b7caabd36627f38b3d45b25da1ffb96aae2c6
- MD5 781db931f24d97a583a77d439cf8879d
- SHA1 be6ca9c9a61511ae248fcdaf8ad03dcbf298442f
- SHA512 828dd921eb573f761aa36f9c1498cb19789226d7a88fbd7cdee8ca11f91a44b4416fa21db17598d41a91b3d178c6d0732c41de5569997144e9493f1677f8240e
- TLSH
  T13101465316337EF591846C1BAC6CF20135ADE803A1B8F8EE742414E4A4AD1A5CD756B8
- MD5 SHA1 SHA512 TLSH
Score

9^/10

execution
- Modifies boot configuration data using bcdedit
behavioral5 behavioral6
- Target
  tweek/GAMELOOP 4.4LAG FIX/.bat/BCDEdit Tweaks.cmd
- Size 87B
- SHA256 d91becdafb3117e17dbc720e942050953c1e94421bf5ce14ed150ba7e89fa429
- MD5 5f2345a1a402bef4241033046a0472a2
- SHA1 0ac64069c6c0137a9f74122c11850cbe69e06052
- SHA512 93d7746d528dfc1d0511ea9c3aa9531bb4560a20c83f62b7f52a2b369a0bfcae0f04689bcb417e25631a16c34dadd8404ab28fddf312af75f97795eb5442cee2
- TLSH
  T15CB012130A032C711943480B94A8F0215018C00C40F1E58CB42002F11D3D080DFC0830
- MD5 SHA1 SHA512 TLSH
Score

9^/10

evasion execution ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
behavioral7 behavioral8
- Target
  tweek/GAMELOOP 4.4LAG FIX/.bat/BCD_FPS.bat
- Size 329B
- SHA256 9e94ccb828a7ff79439004f79a5815e50ea64edb74bbb58899a6988ab6d2739c
- MD5 9bebdf5d66f84fac13c7a34b482fb156
- SHA1 e74591ae538772d52bc288ae94b623012fb670d5
- SHA512 7d9bf3e018d3125d6fe3223bc9d124d4a86dac28bc61c527b7d7ea0d626d214abdb3e55787ff871e860d8f3bfda4c9fce394ce1df7600edd0395a58c70105a6a
- TLSH
  T108E07E221623AEF1094A7E13AC69F206B56CD812AA62B59C752066E145AE1A0DD342F0
- MD5 SHA1 SHA512 TLSH
Score

9^/10

evasion execution ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
behavioral10 behavioral9
- Target
  tweek/GAMELOOP 4.4LAG FIX/.bat/BCD_INPUT.bat
- Size 319B
- SHA256 ad0fc79d0912862a5ba397bd724cdb6634d862fc7edaff8d1b229fc4f805b65a
- MD5 b2febf3146c0f3cf1a4811db144889b3
- SHA1 ae5ee4794d39ecc7c363186f0a14c891909683b8
- SHA512 7686a6c14ccefcedc82b905cc0ffc1ba1dd098bf26792cd6d6a21fac92b01de3e855ac73340375a4573458b03027a442d450f2cb524d42b2d5277083de75df57
- TLSH
  T116E092631263AFF505567E136C78F205B56CE903A9B3F58CB52042F1557D151DD342F0
- MD5 SHA1 SHA512 TLSH
Score

9^/10

evasion execution ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
behavioral11 behavioral12
- Target
  tweek/GAMELOOP 4.4LAG FIX/.bat/CleanPCandEmulador.bat
- Size 909B
- SHA256 f16286562935a0bbccbe54b0cbc4c8f16455a9d727bb34348ff6754e0c11bb95
- MD5 6f65f5e402b74cde73c83bb1a9a8f0db
- SHA1 e3b40725c481ea8476abaf1c1f905dd1a092a710
- SHA512 36bc935381240aa69d04e61c1cb43e6b4b107034d59f7c9b1934f9da92027bcffc67f32fc8abe744be0846a526c7f4ca1ec94aa4d322356a280a9174c283affa
- TLSH
  T11F119C192594434185B22D1E6BFEB77255C8D6431B2C0C07878A56F0A946BFBFA3ACC4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  tweek/GAMELOOP 4.4LAG FIX/.bat/Clear Cache Files.bat
- Size 514B
- SHA256 76f7911df3e36ec22e1950d73dab888c04304f3f154ef3ee7c6584d75b9fc219
- MD5 a122389cec445e0264ef86d9f166de9c
- SHA1 1a2474e2fb1fd0df322b9a3e681685c1efe55156
- SHA512 7f9ae29e32901ad1cd8a8230d1151b247cbe62328298261bd54f0e7b41f9f7905c4d4fdb90df8e14c288dc1ee78c4b5156cf241f17a53bdc7e598c3883ae9861
- TLSH
  T13AF0B4093AA54DA647240A18FB5F01130676BA8F59C40F7C8543D312EFC4A191AB6BCD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  tweek/GAMELOOP 4.4LAG FIX/.bat/Clear Temp.bat
- Size 824B
- SHA256 e0d757843483dadf7e2f51a526f8dbdfa2091e3a32133833535c0622ea082f84
- MD5 b741f2a2026378cfc69acc3393eba109
- SHA1 1066d6b0b1648d291a635f0dd0ca3b3d3e68b8a8
- SHA512 def0b6a0e2fc776051e54fe95818b7a7a68905c3c38824d691ff092bb62c5502084d2f435cf4935e5c49fc131165efac03c116ab1f6ef8aaeb5e0a003067c63f
- TLSH
  T1AC016F1D2994434185B11D1D9BFF72726488D5431B2C0D03879695F0A946AFBFA3ACC4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  tweek/GAMELOOP 4.4LAG FIX/.bat/ClearTemp.bat
- Size 824B
- SHA256 e0d757843483dadf7e2f51a526f8dbdfa2091e3a32133833535c0622ea082f84
- MD5 b741f2a2026378cfc69acc3393eba109
- SHA1 1066d6b0b1648d291a635f0dd0ca3b3d3e68b8a8
- SHA512 def0b6a0e2fc776051e54fe95818b7a7a68905c3c38824d691ff092bb62c5502084d2f435cf4935e5c49fc131165efac03c116ab1f6ef8aaeb5e0a003067c63f
- TLSH
  T1AC016F1D2994434185B11D1D9BFF72726488D5431B2C0D03879695F0A946AFBFA3ACC4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  tweek/GAMELOOP 4.4LAG FIX/.bat/Clear_Temp.bat
- Size 824B
- SHA256 e0d757843483dadf7e2f51a526f8dbdfa2091e3a32133833535c0622ea082f84
- MD5 b741f2a2026378cfc69acc3393eba109
- SHA1 1066d6b0b1648d291a635f0dd0ca3b3d3e68b8a8
- SHA512 def0b6a0e2fc776051e54fe95818b7a7a68905c3c38824d691ff092bb62c5502084d2f435cf4935e5c49fc131165efac03c116ab1f6ef8aaeb5e0a003067c63f
- TLSH
  T1AC016F1D2994434185B11D1D9BFF72726488D5431B2C0D03879695F0A946AFBFA3ACC4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  tweek/GAMELOOP 4.4LAG FIX/.bat/Delay_Monitor.bat
- Size 942B
- SHA256 aa4e2f63da07018bbacbb8c74e94ee6a8119b54dae10cf97b9fc0a1f29153ca6
- MD5 f5536be709d1b50cc81ffb7cf9a898ef
- SHA1 461173129b2ab01996677347c64784d102499e78
- SHA512 2afacd3c13c5077f495d8007ed121c9b20c86b64ca09f5331bafd67e42a5362f3bffea91471c1aa58ed12fac03b83b94192933f781f1303edc53df9959cc3abc
- TLSH
  T1EB1140031657AEF68505BC07BC38FA05766CE80391B5F4EC706461E094BE2A9CE766F0
- MD5 SHA1 SHA512 TLSH
Score

9^/10

execution
- Modifies boot configuration data using bcdedit
behavioral23 behavioral24
- Target
  tweek/GAMELOOP 4.4LAG FIX/.bat/Deletar Arquivos Temporarios.bat
- Size 228B
- SHA256 aff91a4ea10ed45c89fd9f3a458750b6e8ef20fc1f183badc9f8146db96aa097
- MD5 113d18ab90d083d64af29e80c86a6c49
- SHA1 daf71c0f1a767b4f3011fe6d68b369d284dc0357
- SHA512 4dc0b89012da0167f9a5872a1e28beb56ff7807814f0d1bedb0747ff29006a7d971b6fbad9e9df4751f15b5eb21b0b4704e201989cab36f1dc27c8626ef51d44
- TLSH
  T152D0C7041FE505EA47580738159F960309487F8E9E9D877105411114DF85C511FB43C6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  tweek/GAMELOOP 4.4LAG FIX/.bat/Deletar Arquivos de Logs.bat
- Size 51B
- SHA256 263796601565da182d06a1ceefde01a91f81dbf698fb2f2fe82f5ef2a858c643
- MD5 fe6269312a5acb279c81fd4e9c07706b
- SHA1 61fd269f2fe171ec3a1351105a4d55de88d322b9
- SHA512 6fdbaed31112138769e146e633be3074505a9905e05c8d4646e10e576cd89774503b678cf3b2fff3600bc03329c682d0dea408830eae569459c1621446dc0add
- TLSH
  T1CD90025B32082E54565904457ACD028464291182114058A95423C072ED816B44105AE5
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral27 behavioral28
- Target
  tweek/GAMELOOP 4.4LAG FIX/.bat/Delete Log Files.cmd
- Size 91B
- SHA256 28b9645502ddc1536fcc243ba7cb537d45aba04698c3ed8acff3c0f30afbe5e1
- MD5 0b6a1d35ec3be54b5702f217188a776f
- SHA1 97a7d8a0c7e841dbe8b2d11c2ab594b2fb827b87
- SHA512 1a934f0467e3f05272a5ea4c50a7863e11c7e7c0526f15922f8d2074a9c99faa93a8a56f1484328969cdd5fbb5d2a49ca7e2b1581a68c14334488a6d887a212b
- TLSH
  T15FB0120278045DA00B85188A06DE204A201565462152E8BC80621433BCDC0F024041D3
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral29 behavioral30
- Target
  tweek/GAMELOOP 4.4LAG FIX/.bat/Delete Temporary Files.cmd
- Size 273B
- SHA256 b75c09af165c8e42d780a00142451b6f5745cafab60f0957ca018c17b878a703
- MD5 2ffb5f1c8e8e17ee9b40108f82c6bdab
- SHA1 47e27a22fcdfb68e9b1f6a460fe6ddc33e9a3a34
- SHA512 4410f3a2ca03ca59bd92aa18792d2523c0fe04a033758266090cf140c1e4830d28aba43fd549513f3c81e91e5cc984dbb8da8811e4d8fb9a46df1df1366b8e92
- TLSH
  T19BD05E001EE504FB4B581B3816AFA6030908BF8FAE998B7044422118EF85CA12F783C7
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery execution
- Modifies file permissions
  discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Modifies boot configuration data using bcdedit

Modifies boot configuration data using bcdedit

Modifies boot configuration data using bcdedit

Modifies boot configuration data using bcdedit

Modifies boot configuration data using bcdedit

Modifies boot configuration data using bcdedit

Reads user/profile data of web browsers

Reads user/profile data of web browsers

Modifies file permissions

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32