565b5881bf58b3837a53f24a37825f2bc4cfa56233d660ecf45377c00378bd86

General

Target
Cosmic.7z
Size 179.6MB
Sample260815-b6ds1sdc28
SHA256 565b5881bf58b3837a53f24a37825f2bc4cfa56233d660ecf45377c00378bd86
MD5 f86320193aac60a1ee83731cd2cb799f
SHA1 73cc0d213713a885b477e1ca4ad5d8d115224969
SHA512 6cfa2d32f19a3d6227e90a81e43466d6dc48d5af92d0df6ddd9fd3be41bee364a4d39f8c8a6a59cb5d32ab39b59299e428da24fc6dca75e40102082cabe4e91a
SSDEEP 3145728:nnq6261DKxW+lKgzMBB7EeVMLVOqjgG3tW53ni44LbdDRvch4z2b9JiH39a/vVjJ:nnq6V1GIgzmBgOMLQ6t4c44Lbdltz2DN
TLSH
T1449833467583CCF6C4D5698E280E522FED313C3DDB36206DA0716279CA3BAE74B4999C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Cosmic.7z
- Size 179.6MB
- SHA256 565b5881bf58b3837a53f24a37825f2bc4cfa56233d660ecf45377c00378bd86
- MD5 f86320193aac60a1ee83731cd2cb799f
- SHA1 73cc0d213713a885b477e1ca4ad5d8d115224969
- SHA512 6cfa2d32f19a3d6227e90a81e43466d6dc48d5af92d0df6ddd9fd3be41bee364a4d39f8c8a6a59cb5d32ab39b59299e428da24fc6dca75e40102082cabe4e91a
- SSDEEP 3145728:nnq6261DKxW+lKgzMBB7EeVMLVOqjgG3tW53ni44LbdDRvch4z2b9JiH39a/vVjJ:nnq6V1GIgzmBgOMLQ6t4c44Lbdltz2DN
- TLSH
  T1449833467583CCF6C4D5698E280E522FED313C3DDB36206DA0716279CA3BAE74B4999C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery ransomware themida trojan
- Executes dropped EXE
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1
- Target
  UI.exe
- Size 16.8MB
- SHA256 d182e90cd23d0a49c09714cc354de34f9ae73673a8cfd3d1be2219f0d7a9bd38
- MD5 c47650ae80ea6f01b31c5e66be2a79f4
- SHA1 ef487390ae03b7288c94e6eb74b60a5ebed3d35d
- SHA512 6bfa5840bc413a97202094decd99d456f8b6c416c4d0ff6ab009fae28c9047b74459f9ce4cdda539cd6180a10d03cdeba96d373035832a805b3535edd1ff3a71
- SSDEEP 393216:P7AsyOLF2xBsuphiF0cSU+uPaayFsmkTe:P7AsyOLF2xBsuphiF5SU+uyDsmH
- TLSH
  T17A0718257B5A996CD19BC47483478AA20A7030DB0F39B9FF548596383F79BF46F38218
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

Process Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Themida packer

Checks whether UAC is enabled

Network Share Discovery

Discovers running processes

Checks whether UAC is enabled

Network Share Discovery

Discovers running processes

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2