57a70024e75d367eee53419f204d6518eb77b582cdb203dc9c5e057e027415e7

Sharing

Copy URL Twitter E-mail

General

Target
Control Center Setup v7.15.10(64bit).exe
Size 134.9MB
Sample260809-wajplswsez
SHA256 57a70024e75d367eee53419f204d6518eb77b582cdb203dc9c5e057e027415e7
MD5 8e5b6d500276b2ed0e641a7586494468
SHA1 8159895b54dc16ebbdcac93b0ce95b812a46411c
SHA512 19da3abe282faf1d4970f3f9fe3af61ce4fadb06170ee73768953633e80664130d3bd0c7075e26b9c31c7278a9cae1f13a20f6709d349cbaf23a1fbd6397abe2
SSDEEP 3145728:A8Trpq3fKOf4qKqYFeqNkFMokaCZOHqVxpX6l49Kqr:AWpq3fKOrOeq4Mooltr
TLSH
T1466833DE7022D097D96E91B40A598E5AE80C5375DF13B92DBDE8B3E6C40CBB009B2D47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  Control Center Setup v7.15.10(64bit).exe
- Size 134.9MB
- SHA256 57a70024e75d367eee53419f204d6518eb77b582cdb203dc9c5e057e027415e7
- MD5 8e5b6d500276b2ed0e641a7586494468
- SHA1 8159895b54dc16ebbdcac93b0ce95b812a46411c
- SHA512 19da3abe282faf1d4970f3f9fe3af61ce4fadb06170ee73768953633e80664130d3bd0c7075e26b9c31c7278a9cae1f13a20f6709d349cbaf23a1fbd6397abe2
- SSDEEP 3145728:A8Trpq3fKOf4qKqYFeqNkFMokaCZOHqVxpX6l49Kqr:AWpq3fKOrOeq4Mooltr
- TLSH
  T1466833DE7022D097D96E91B40A598E5AE80C5375DF13B92DBDE8B3E6C40CBB009B2D47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery installer persistence privilege_escalation ransomware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1
- Target
  CCEntActionUtilRes.dll
- Size 74KB
- SHA256 376850c7bf9ae84473469cfbfa66c9a7c5068f689d45778ac2d8a2e1b2acaf7c
- MD5 8e2b41512264b31c2922695e8c4fb077
- SHA1 4fd8c136bb802be2d0444fd071aefee4d0c47f7b
- SHA512 56a299a601ea3d362762e4ca98c44e417d0de32786b22c87f56a5bd22c86f25d92873860bb0acfe1d1414162494845d2f621b8535b6d5688dda23aaf8448b3af
- SSDEEP 768:Ao4g0aMqhjuw/9J5X0svzOl9t51VttfYvV4YVttfYvo4sZ7pc7:g0Ol9tvVttfYtpVttfYsU
- TLSH
  T105738432B1958543E0D8B0F34C679BA8A8746C6C9C70857A167C7609DB717838FEFA9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  CCEntConfigRes.dll
- Size 436KB
- SHA256 2b55af38cdc233bacb8013ccc30d87a76e8a53fa7620ac771f23d0f42ade03b4
- MD5 10af9ce675267994648ac5c7f7a10244
- SHA1 6126b0e12fee83b4454de6ab60cbe990360c86c1
- SHA512 30b1343aa5d640faa0c9cde29fdf3cd814a72613bfae782d09418f66e3b100787aee77514fe6f69e5c9767db8a3b01e3f0b449472c5a56376a92273e6a855ad5
- SSDEEP 6144:5OlP9cVhmBwnghFYxh89MCM9YsjlDXY5jzXVGMGZNspdJxyvR9nZfv5+N1zOO/p:Q8hmughKh6GMGZNYiR9nZfx61zOO/
- TLSH
  T12994732AEB54C863D0A0517A4C9F8BF752307D496E204F13BA08BF4FA53B757EA56708
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  CCEntErrorUtilRes.dll
- Size 46KB
- SHA256 b278a540891771f5697b8eaeba1f71828647bf011224bdb09d7ff047074a1696
- MD5 0a71e4cbc40344c4b191807f43e5b276
- SHA1 3a328a537a3d0b02dc4fc48f24c625e4c868cecc
- SHA512 e6d520a5ceaf13f0c5db788f70c74bef555a8181e260d96ddb045ea6792525a43da05b53c56abcd8c5aa7b65c543909063c1f1b6f77fca94f3d7383431a235f4
- SSDEEP 768:Po4g0aMqhjlwPlmfsvzOljuL7c7+VttfYvrT4urerk:hEUOljuPRVttfYDF
- TLSH
  T1C2239532B1958503E0E971F34D639B648934BC299D20867A177C360DDB327838FEBA6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  CCEntEventUtilRes.dll
- Size 1.6MB
- SHA256 b429aa0b9549a377a52dc18579af628e7b07f8d1ff9845d1a9b5162cda4a5750
- MD5 9bb2c1f8a114124fbea47bde3802f0e6
- SHA1 e801aea143ba02ff1c59286771937a5672f43c0f
- SHA512 46e964697b8ed150fc22f82a93bccfbcbee89b6090464f2a464c885e95079aaac5c978cc6c6240c21bee5cbe3dc2db53daee9dba929b1cb04e2167ef03e8bc9b
- SSDEEP 24576:pl6oPzW8IwWvMbAWzmFWvMbYWvMbYWvMbLa3jC:pl6oPVgiiLa3j
- TLSH
  T1B175F572BB05CE12C98424B6CC2FD6EC1611BD54AF60847B37997F2FE770346059BAA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  CCEntMapEditorRes.dll
- Size 364KB
- SHA256 4043a17a6b105295a5b3d9644b075abffa99efb07f77711ca64203c00e2d3fef
- MD5 93a1842eb4ae8cbc4201a14070297374
- SHA1 519feb7fae98fd995d6ac6f6d3509af92d3e1030
- SHA512 f138e1a8f66349cb9785918946717470c0d10e9ba3a7f53b5bbdb048689ff99dfae4e58757fd103f975d1aad7a1d1c01da8af59ef17d4deb87f06bbc24dad524
- SSDEEP 3072:lUOlPNNqVzBFO7M42RQQuEZp0duDQGyzZ3:+OlPNNqVaLJ
- TLSH
  T1F8848022BD6DD592E5187179CC1ACADD6024BC75BDD00527B2A3BB6FEB31722DE0220D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  CCEntMonRes.dll
- Size 4.4MB
- SHA256 26114f84be0069f7a798513ffa605c01971c78a3495edf5b24d48aee0d47592f
- MD5 cce9367f5c908e4860413962fa32a30d
- SHA1 9147c3c2cede87b1028f1e7961b9131e228cc97f
- SHA512 01b2008b1a0a8b1064c44c4f5e86374cecfb44c02d7262dac664fabfb41ded8d6e9de81275842438e42e8c7d3dd313cc16d2b3a7a29520cfc7aa3b96ad215b3d
- SSDEEP 24576:hM6oPzW8IwWvMbAWzmFWvMbYWvMbYWvMb2HcUQCI+GkdgUVxQOkP:hM6oPVgii2HxxQO
- TLSH
  T1FE26B36231A1C425CD0529B5CCAEE3EE6539BEA08DE8501B2BC97F1FD734317493A798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  CCEntPeopleCountRes.dll
- Size 91KB
- SHA256 666250098ffb14cefbdd57f0c4c67606e8619ac986c9b45133fea470cace1a75
- MD5 4224268515a813cce03bf86e3bdd9cfb
- SHA1 c26c8a2449987e750e98b0e499e541e8323329f3
- SHA512 3d421a6b54415efa31e6405e1310e1febc561b03449f8b7217df737ced5ec58fcbcb2a858723acd734671d95351b9e5cef53c8bc62798c191710bb1facfcd73d
- SSDEEP 768:Vo4g0aMqhjlwPymfsvzOlcKb08+ZZzFFfSpllvLW47kiV/E1y47kiV/E1mImOj:MEUOlcKb1+CW479sM479sjj
- TLSH
  T1AF93C647B1B2D17BD72419304D2FCBEA767CAC8A59D06E5723A0BF7EED326422507244
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  CCEntPlayBackRes.dll
- Size 1.3MB
- SHA256 99085073583943b630637f2f7212fca25030f5676490fbcf466dd6ddc7ee6f31
- MD5 12487636e251732aad92a6f69dd06725
- SHA1 2d96f27162e08cec7c686b930d731effd55388bf
- SHA512 8f686b43ebe1294b5e4e8aa40f7918c26eb8265397558a0e4167d707dd5c3a9d91b751a227096f66a2b34006f249b806e700804e806baa05ed8126df4a0df56f
- SSDEEP 3072:6UOl56TcnLWmboCYTOzkj+vEABQpswaEsmhe80BpwqZh30IBkrqFTP2PAN/FNFNW:xOl5RnLBETOzqpsNhEImrqn/7
- TLSH
  T16E55FD096DAC94E3D6F06DF58C9CA26636EDCC41B8A09D2A2615FE3BCC33701445F9E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  CCEntRemoteDVRRes.dll
- Size 31KB
- SHA256 8550dd9eb642b6e17b09339cad59c225b17fd6e9726f3b194aa616ff8f84cc74
- MD5 145e13cfec34eb7a6e466b9bbcd47af5
- SHA1 28628fb236005351c9ce268b0b650e2e57e93c85
- SHA512 579f3f97c94d9deb93f679e81409f792a5d2640684bf1555da672a40c626f2a2ad7718523a86ae2108a57842b37ded103188e99e9fed2c4c850a1de4d60375ea
- SSDEEP 768:0o4g0aMqhjlwPrmfsvzOlYlKMuXS0xem:KEUOlYo5XSsem
- TLSH
  T16BE2C462B706C0D1E2E95930D5D7CF0511BABD2B29C01ADF47BA7A5C3C736487428AAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  CCEntSBRes.dll
- Size 142KB
- SHA256 4b784ffe5d7a9252b45800987324a2991b44a0be856e31225fd2024a08c344fb
- MD5 da5fd86a4a1c7a0bf80ba256adb48901
- SHA1 8d3079d77e17719e2483cc8d957f2caa69363584
- SHA512 de314982eee7b33f8c2b66daed9711fcef23352a757640ef8050e89946fdc082d7ad24180001b266e9992160db54dd2d8bcabeb1880ffd6d1c1b501d9c88eab1
- SSDEEP 1536:LEUOlZSqvhhbBPbqZhcbQ3PWADQzrTYb2:IUOlZSqvhfqZh3y
- TLSH
  T1AEE39407BE9DC843D45014388D9FCBF99610BC9EBD21822B7A987F2FEC35B019959B19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  CCEntUserManagerRes.dll
- Size 65KB
- SHA256 c89cb3ff7b7747e9083ac17a5aee85467a783cc62464f736d28ec79dfc7a76d4
- MD5 35a11589aa1bff3bdd8d7a4da757c6d5
- SHA1 c5870eb5fd8625f81952808771ca813476e7407d
- SHA512 1c8c24b3c28753546539463813d4a5362a0e031c8d8b08c033e499f9bb95bb25e2d3873fb07002bf42f6c91d0bebbf24a68a42db6fd15a504accc0d219171e36
- SSDEEP 768:Zo4g0aczTVwv5mfsvzOlC6eUtS+pOxVttfYvvA1:WEUOlC6eiS+0VttfYnA
- TLSH
  T19153623661458DD3D0C460F34E134BB455236C989DE191A61E2C3AEB9B3F3B38BDB988
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  CCEntWESPTreeRes.dll
- Size 38KB
- SHA256 23c95000a0abbb4daacc0fed1a104c3b6b571c7c74936fa945eeaefe4a50fc89
- MD5 adee32cb2d256db16ac1b931058dd82f
- SHA1 be913f0c9d57b85a866653c79514e9c7938f6db1
- SHA512 498c93689ea01c73a0bc002192b8d43766e838556bce377b766637afb9a4b0566cf57b610d1281cac08c9a34a2a4d1c89526e37bfc96cb25a3f443f7c7765531
- SSDEEP 768:Vo4g0aMqhjlwPJmfsvzOlED5zT+PguVu+q0zR+iIVfioLqJ8sJxgcW8aj7cu:7EUOlEhgn2
- TLSH
  T18703A505B3FAC952E0A1473845B39FD20171B89152228F4BBF64E78F6E76B40DE1B786
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates connected drives

Checks computer location settings

Drops file in System32 directory

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13