99a86b53c879ad17ffc62d4d9ef587e9ff4950c4e5f199a19f4c853837483fc5

Sharing

Copy URL Twitter E-mail

General

Target
XTweaks.Free.Setup.1.0.3.exe
Size 132.6MB
Sample260816-d1m6lsba62
SHA256 99a86b53c879ad17ffc62d4d9ef587e9ff4950c4e5f199a19f4c853837483fc5
MD5 345051724646cf12572521a7e9fa2133
SHA1 868bbb58d1d39cd3c1f19cb692f46fcfed9fdfd9
SHA512 2b9e7fd3a24b3fc4471d76e931c1189c7b11e9249eb8e5a9bbc5a44c68a2d10df8e95c444a456efd4b2c424fb79e67b926c24c818f4c2841cd1f79711ab06476
SSDEEP 3145728:z7e4DoxftdrJmIoFyHQp4XXgelyI/0A/3/vHLosEWv/:m4DYzrJ3ioQpWRVcA/3/vWWv/
TLSH
T1BB683327B56D18FDC1C4FBFC822E0655D10F6C8E6A4A21A331B991FAE5F8C035E159CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  XTweaks.Free.Setup.1.0.3.exe
- Size 132.6MB
- SHA256 99a86b53c879ad17ffc62d4d9ef587e9ff4950c4e5f199a19f4c853837483fc5
- MD5 345051724646cf12572521a7e9fa2133
- SHA1 868bbb58d1d39cd3c1f19cb692f46fcfed9fdfd9
- SHA512 2b9e7fd3a24b3fc4471d76e931c1189c7b11e9249eb8e5a9bbc5a44c68a2d10df8e95c444a456efd4b2c424fb79e67b926c24c818f4c2841cd1f79711ab06476
- SSDEEP 3145728:z7e4DoxftdrJmIoFyHQp4XXgelyI/0A/3/vHLosEWv/:m4DYzrJ3ioQpWRVcA/3/vWWv/
- TLSH
  T1BB683327B56D18FDC1C4FBFC822E0655D10F6C8E6A4A21A331B991FAE5F8C035E159CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  resources/app/node_modules/three/src/nodes/materialx/MaterialXNodes.js
- Size 8KB
- SHA256 5325f75ceac88fe8dd1d647ad063bb44e65bb93f962fd16f4071c44ab1668767
- MD5 c581aa89a3181f346d09481a4edd9262
- SHA1 da651fc7185685fcc2b204cdac590a575031347e
- SHA512 9a92d727493fa3c33a99b8b958b65bb61b8510c9e3b2872f24ea1a474d3e2e057ecdf27df406783814be4f20d1b72a09614af66c988620549f14d07b42efa6ec
- SSDEEP 192:MuwmmI99s43IaEPhCkIbybn8D1rKxYc93NGXBbvymng7p6r6SO:HIrCkwOn8D8GXBbvymnnI
- TLSH
  T13A0235522693411EFB30A0D45993841FA73C63713800D9E17E4EEBA069CB15DC3BAFEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  resources/app/node_modules/three/src/nodes/materialx/lib/mx_hsv.js
- Size 2KB
- SHA256 a5c42b9ebb9413c3d7cea06f4d998201a4816930aa617309174e6d68ba354aaf
- MD5 8db40bd12885e9c0fbd6bd100cd4383e
- SHA1 4928d8f406d3518abeefe0dcff347987fc23a9de
- SHA512 b187950e07c3cd121d1973d8d51f14385161da2e4b2deb3a319ee71fcefb8918afb764893d84aa1e5ec89db307c0f675bd96df3839adff96058752ff8de81001
- TLSH
  T1C651BEC0177D323D9D7E80D84A3EC4979378A01DB9C5C5B5590C10B696D23AD8BFAFA0
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  resources/app/node_modules/three/src/nodes/materialx/lib/mx_noise.js
- Size 44KB
- SHA256 79ee80b885707c947b2d2477c3056b58fe3f3267050c525f7f26628796df7248
- MD5 06569a1b3e93ab722329c8ddd9fa5138
- SHA1 d881ae1ecc1d412c62a81be7bba0f0480d1bfb2e
- SHA512 52546003c2615bb7be896192033a75ad93040ef6f502acb8d9bb783ab7606db22371adb54a9b26217fa3b84d560cd530b232859a2346b20c310602309e909705
- SSDEEP 768:lU1Q5cwzvdy/rUaHpRaUMPrYzvslfJXU8e8S58eoQW:lU1Q5cwzvdy/rUaHpRcj
- TLSH
  T12023F041A32A73AEFEED84F889278341E52CE0497948BCF1518D547E639239E827DF71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  resources/app/node_modules/three/src/nodes/materialx/lib/mx_transform_color.js
- Size 862B
- SHA256 fe1703c337c2c49a00cb85c0af18c1b0f427aa7ca0c92ab22bde1c11e1daae6b
- MD5 c6d258584d208a5183705fa23699af69
- SHA1 114327a61af0d69e4dbc2a0ad831b95dd874cee1
- SHA512 63418858a2bf293e2a75a6f618824884a4b669d098b55c0798dfb3317121c27f71934b59c7e1274ea77299a0fa9eeacca709898ebbbbac734b8500f1ad8c7802
- TLSH
  T1A1118025E669B33F793B10D88850E500675C944E7900EEFD3B2F9974E34115C82E97A4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  resources/app/node_modules/three/src/nodes/math/BitcastNode.js
- Size 3KB
- SHA256 8fccba3c86c95cc6c1ce268633ea37f20e86ee167c337cf2354941f5fd444420
- MD5 d3f2dc279f5c5bb15fb226407768d8ce
- SHA1 1f49924f0af819018a40cb570510a997b1b11a14
- SHA512 3fba4a095de70e2d84ec5cb9c515b10cdb86daa25118fe0872e19a0c35bed7c657a17f88ed41ae2eb7d6afec5ecfe4c828ad80160c3698108377e330df5ed3e5
- TLSH
  T1D471E0C17A19A3136D1720B21EE942D0ABB895ADB3B609EC344E5C343949D2E4FF9FC5
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  resources/app/node_modules/three/src/nodes/math/BitcountNode.js
- Size 8KB
- SHA256 0cd713ba872a6e6c1c476c1e33248e87dbb1db74fbd5b1fc296071966e4cc2ec
- MD5 a9c4ec814cbde4eb164d8ca7da5b573a
- SHA1 fe70400c997b5481944ff5258d8423114be43af3
- SHA512 591a7c9a92e9473cb6ca27689684059a9e8054b44cf1ab773d2aba9890ad7492ea5a4de1c3e34f0c9bfc0af0ec486e1179e7146f91b447d750371775d84199d9
- SSDEEP 192:bmT64/8eRakYfdHMEgCCjGvWTk24PTWTfT2v91cw/Cqq:8fkeQkY1HrgCPvIMI7G1a9
- TLSH
  T18812A5C57E1C321B5F2A21BC76BD31CC90BC903532628CF9AD8AA95805D58B557F9FE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  resources/app/node_modules/three/src/nodes/math/ConditionalNode.js
- Size 5KB
- SHA256 30648971b986ccb4dac74d93c33094b4cd8a10026870d9ef305a5686016f0572
- MD5 16dddd7484a67b161de838d492d1a95a
- SHA1 167594abe28fe169c5a35f36824ac1bf47ea34aa
- SHA512 5cc557ee335bed828ecb5e768be494dcf90bb7f7774894a6ee452c9b0f3c209730d7debb16929e57e3f23daf11059b3dc62fdb3df93946c97058e6b964ee101e
- SSDEEP 96:9fzceRPcznWJgNng1FavE9J4XVf6tl/I/9zPk/1M6NOi/+82NXcHwbks:D6VcMvE74cLMbp8g
- TLSH
  T1DCC166F227EC4237719760D82A7923E8C07D9032777854B83A8D8FA465E7118837EE39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  resources/app/node_modules/three/src/nodes/math/Hash.js
- Size 665B
- SHA256 4e7b7268a22ed74b5dcb9a53dc8b0e6580bd3fd350d8e12e1a7b957e375f6a6d
- MD5 625b1e4739b3a8b04afbefccb0b6db9c
- SHA1 e4d36b18ff20443c16b85b1db71b4bb95e593699
- SHA512 544c9465df2e9534a752d0202be1f767154647bfeed7a87864c7776793766234bf351729fea901338edefc6dbc2d824bebac279882ecea79bd5ee10baa52bf49
- TLSH
  T15A0199E03C1AA11A2F3121F185D85513BBA9E1DC721F8974409D5A9428EB093B0BEFAA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  resources/app/node_modules/three/src/nodes/math/MathNode.js
- Size 29KB
- SHA256 2ce8b990775d826ece60f2d4edc5cce20ec7c5cdf32633f069101bdfd79698f6
- MD5 4ccf58f17f385616b78841a4b4b1768c
- SHA1 1c26a592d835e21a65e6f2ad86b62c62b5c2c1be
- SHA512 c13a0a7f12cffad81ef35306b64cb6d258aa89b4dff04d1ffeecf8948cfd52889abbaa07811dabb04e338f1f5f5db00362711f38a7d4bbb1eb7bd321f4f1131e
- SSDEEP 768:E7vxxPXtu4bKk6zsjZubTzlFM1gMidc5hGJs3fXdRQbje8mM:Ezocgfm0i3rOjeDM
- TLSH
  T1E2D20199371FA31736135AF870FA919414F8A626B12774083BC95E380DCEC619BBDF88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  resources/app/node_modules/three/src/nodes/math/MathUtils.js
- Size 2KB
- SHA256 62adaab531fdaa909bafae98d722d09626703ed2665a9be80056dd90d305cfab
- MD5 e568cacedad5443900b507a30171741f
- SHA1 3e5e4b3d7e582444ce3edaa78cb4b3f35c2ad8f7
- SHA512 cae7d5b7cbf63c6ad45223f9425ce6028ff903a729c9631edf4820ed2c970324f4a581a688034626d81b7b13e86c30d50a03bb11238d942d02fa2394daed5afa
- TLSH
  T14F41104F3675132F762169AA45CF515AC4A881BA77B304B412CE5DE80CE94A0C937FEC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  resources/app/node_modules/three/src/nodes/math/OperatorNode.js
- Size 16KB
- SHA256 a43573166e8ecbf5769979ee5e36bc365dece1f02c46908b9cee69f74c682fad
- MD5 8b0b58ebb2e61983eacc956a1a05abeb
- SHA1 ce0370036d2b428a6b969e97fb037477e71d7630
- SHA512 92543b32cb77582137e94493b539cafd9357a3d372e4f68606792ba5348ed4292f476623c902dccf1f74dcd1de5d0fd4e4f9e1397a65744d5dc2c9d0a2dd1341
- SSDEEP 384:z4HlIrSpxaArwMiiEgbiM2YK9sRSe4wo/0ZZhsM3g+71uox2Yw7:z4HlIGpkArWiEgWmK9sRSe7o/0tsM3g/
- TLSH
  T1C47272E533CEA32B662372E978E955B5E17CF434B227680A21CE7A345CDD82017B5F18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32