732fa6bea330ed383ebf7c153edb9944028f09659c16ab48e42728f18244c2dc

Sharing

Copy URL Twitter E-mail

General

Target
adnam.zip
Size 262KB
Sample260816-ja96cas1c1
SHA256 732fa6bea330ed383ebf7c153edb9944028f09659c16ab48e42728f18244c2dc
MD5 5ece13666174eae0d71126a11bce8518
SHA1 31cfebeabfcab19b6981737941e9899a7984816d
SHA512 a04f419fff5e32f9f0f945087300f1dcff6986594471858338195ef109532d6be1d14cd8f448246a4e44167dc009bcea4894ba8641ca2296d0d433ed3bedbd6f
SSDEEP 6144:br7rXiMxHLSZBLEhf38degTRdd1yKctPbVsznItkC8s:br7x4ZBLm3hgH1yntVFtkfs
TLSH
T1DB44122E6E2D3502CA55E3F8C6D5FFCEC1AEC06E2B619C01787251335CE66A18F5B129
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  crow(Copy 10).bat
- Size 95B
- SHA256 01416853f9ba35a80ea108be16c4633b3ddbb24c3c32b9de44d6298adf0b1711
- MD5 fa8d20242e8a97481ca4aebff18553a5
- SHA1 2704f4ca0350767730356f3c86cfd677a1902da0
- SHA512 5d330e01966e22e8fe60154d547e8550667acd24fda023fb61c2af9ee924103cf7f4702e59da726889c1ee0fd64fbbee694c5e5e4cd6d32611e96208ec66c474
- TLSH
  T1A0B0126623491238E2344884C4DB8D03D42EEE2053194ED8A24CD170188FC84015F15A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  crow(Copy 11).bat
- Size 95B
- SHA256 01416853f9ba35a80ea108be16c4633b3ddbb24c3c32b9de44d6298adf0b1711
- MD5 fa8d20242e8a97481ca4aebff18553a5
- SHA1 2704f4ca0350767730356f3c86cfd677a1902da0
- SHA512 5d330e01966e22e8fe60154d547e8550667acd24fda023fb61c2af9ee924103cf7f4702e59da726889c1ee0fd64fbbee694c5e5e4cd6d32611e96208ec66c474
- TLSH
  T1A0B0126623491238E2344884C4DB8D03D42EEE2053194ED8A24CD170188FC84015F15A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  crow(Copy 12).bat
- Size 95B
- SHA256 01416853f9ba35a80ea108be16c4633b3ddbb24c3c32b9de44d6298adf0b1711
- MD5 fa8d20242e8a97481ca4aebff18553a5
- SHA1 2704f4ca0350767730356f3c86cfd677a1902da0
- SHA512 5d330e01966e22e8fe60154d547e8550667acd24fda023fb61c2af9ee924103cf7f4702e59da726889c1ee0fd64fbbee694c5e5e4cd6d32611e96208ec66c474
- TLSH
  T1A0B0126623491238E2344884C4DB8D03D42EEE2053194ED8A24CD170188FC84015F15A
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  crow(Copy 13).bat
- Size 95B
- SHA256 01416853f9ba35a80ea108be16c4633b3ddbb24c3c32b9de44d6298adf0b1711
- MD5 fa8d20242e8a97481ca4aebff18553a5
- SHA1 2704f4ca0350767730356f3c86cfd677a1902da0
- SHA512 5d330e01966e22e8fe60154d547e8550667acd24fda023fb61c2af9ee924103cf7f4702e59da726889c1ee0fd64fbbee694c5e5e4cd6d32611e96208ec66c474
- TLSH
  T1A0B0126623491238E2344884C4DB8D03D42EEE2053194ED8A24CD170188FC84015F15A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  crow(Copy 14).bat
- Size 95B
- SHA256 01416853f9ba35a80ea108be16c4633b3ddbb24c3c32b9de44d6298adf0b1711
- MD5 fa8d20242e8a97481ca4aebff18553a5
- SHA1 2704f4ca0350767730356f3c86cfd677a1902da0
- SHA512 5d330e01966e22e8fe60154d547e8550667acd24fda023fb61c2af9ee924103cf7f4702e59da726889c1ee0fd64fbbee694c5e5e4cd6d32611e96208ec66c474
- TLSH
  T1A0B0126623491238E2344884C4DB8D03D42EEE2053194ED8A24CD170188FC84015F15A
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  crow(Copy 15).bat
- Size 95B
- SHA256 01416853f9ba35a80ea108be16c4633b3ddbb24c3c32b9de44d6298adf0b1711
- MD5 fa8d20242e8a97481ca4aebff18553a5
- SHA1 2704f4ca0350767730356f3c86cfd677a1902da0
- SHA512 5d330e01966e22e8fe60154d547e8550667acd24fda023fb61c2af9ee924103cf7f4702e59da726889c1ee0fd64fbbee694c5e5e4cd6d32611e96208ec66c474
- TLSH
  T1A0B0126623491238E2344884C4DB8D03D42EEE2053194ED8A24CD170188FC84015F15A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  crow(Copy 16).bat
- Size 95B
- SHA256 01416853f9ba35a80ea108be16c4633b3ddbb24c3c32b9de44d6298adf0b1711
- MD5 fa8d20242e8a97481ca4aebff18553a5
- SHA1 2704f4ca0350767730356f3c86cfd677a1902da0
- SHA512 5d330e01966e22e8fe60154d547e8550667acd24fda023fb61c2af9ee924103cf7f4702e59da726889c1ee0fd64fbbee694c5e5e4cd6d32611e96208ec66c474
- TLSH
  T1A0B0126623491238E2344884C4DB8D03D42EEE2053194ED8A24CD170188FC84015F15A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  crow(Copy 17).bat
- Size 95B
- SHA256 01416853f9ba35a80ea108be16c4633b3ddbb24c3c32b9de44d6298adf0b1711
- MD5 fa8d20242e8a97481ca4aebff18553a5
- SHA1 2704f4ca0350767730356f3c86cfd677a1902da0
- SHA512 5d330e01966e22e8fe60154d547e8550667acd24fda023fb61c2af9ee924103cf7f4702e59da726889c1ee0fd64fbbee694c5e5e4cd6d32611e96208ec66c474
- TLSH
  T1A0B0126623491238E2344884C4DB8D03D42EEE2053194ED8A24CD170188FC84015F15A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  crow(Copy 18).bat
- Size 95B
- SHA256 01416853f9ba35a80ea108be16c4633b3ddbb24c3c32b9de44d6298adf0b1711
- MD5 fa8d20242e8a97481ca4aebff18553a5
- SHA1 2704f4ca0350767730356f3c86cfd677a1902da0
- SHA512 5d330e01966e22e8fe60154d547e8550667acd24fda023fb61c2af9ee924103cf7f4702e59da726889c1ee0fd64fbbee694c5e5e4cd6d32611e96208ec66c474
- TLSH
  T1A0B0126623491238E2344884C4DB8D03D42EEE2053194ED8A24CD170188FC84015F15A
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  crow(Copy 19).bat
- Size 95B
- SHA256 01416853f9ba35a80ea108be16c4633b3ddbb24c3c32b9de44d6298adf0b1711
- MD5 fa8d20242e8a97481ca4aebff18553a5
- SHA1 2704f4ca0350767730356f3c86cfd677a1902da0
- SHA512 5d330e01966e22e8fe60154d547e8550667acd24fda023fb61c2af9ee924103cf7f4702e59da726889c1ee0fd64fbbee694c5e5e4cd6d32611e96208ec66c474
- TLSH
  T1A0B0126623491238E2344884C4DB8D03D42EEE2053194ED8A24CD170188FC84015F15A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  crow(Copy 2).bat
- Size 95B
- SHA256 01416853f9ba35a80ea108be16c4633b3ddbb24c3c32b9de44d6298adf0b1711
- MD5 fa8d20242e8a97481ca4aebff18553a5
- SHA1 2704f4ca0350767730356f3c86cfd677a1902da0
- SHA512 5d330e01966e22e8fe60154d547e8550667acd24fda023fb61c2af9ee924103cf7f4702e59da726889c1ee0fd64fbbee694c5e5e4cd6d32611e96208ec66c474
- TLSH
  T1A0B0126623491238E2344884C4DB8D03D42EEE2053194ED8A24CD170188FC84015F15A
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  crow(Copy 20).bat
- Size 95B
- SHA256 01416853f9ba35a80ea108be16c4633b3ddbb24c3c32b9de44d6298adf0b1711
- MD5 fa8d20242e8a97481ca4aebff18553a5
- SHA1 2704f4ca0350767730356f3c86cfd677a1902da0
- SHA512 5d330e01966e22e8fe60154d547e8550667acd24fda023fb61c2af9ee924103cf7f4702e59da726889c1ee0fd64fbbee694c5e5e4cd6d32611e96208ec66c474
- TLSH
  T1A0B0126623491238E2344884C4DB8D03D42EEE2053194ED8A24CD170188FC84015F15A
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  crow(Copy 21).bat
- Size 95B
- SHA256 01416853f9ba35a80ea108be16c4633b3ddbb24c3c32b9de44d6298adf0b1711
- MD5 fa8d20242e8a97481ca4aebff18553a5
- SHA1 2704f4ca0350767730356f3c86cfd677a1902da0
- SHA512 5d330e01966e22e8fe60154d547e8550667acd24fda023fb61c2af9ee924103cf7f4702e59da726889c1ee0fd64fbbee694c5e5e4cd6d32611e96208ec66c474
- TLSH
  T1A0B0126623491238E2344884C4DB8D03D42EEE2053194ED8A24CD170188FC84015F15A
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  crow(Copy 22).bat
- Size 95B
- SHA256 01416853f9ba35a80ea108be16c4633b3ddbb24c3c32b9de44d6298adf0b1711
- MD5 fa8d20242e8a97481ca4aebff18553a5
- SHA1 2704f4ca0350767730356f3c86cfd677a1902da0
- SHA512 5d330e01966e22e8fe60154d547e8550667acd24fda023fb61c2af9ee924103cf7f4702e59da726889c1ee0fd64fbbee694c5e5e4cd6d32611e96208ec66c474
- TLSH
  T1A0B0126623491238E2344884C4DB8D03D42EEE2053194ED8A24CD170188FC84015F15A
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  crow(Copy 23).bat
- Size 95B
- SHA256 01416853f9ba35a80ea108be16c4633b3ddbb24c3c32b9de44d6298adf0b1711
- MD5 fa8d20242e8a97481ca4aebff18553a5
- SHA1 2704f4ca0350767730356f3c86cfd677a1902da0
- SHA512 5d330e01966e22e8fe60154d547e8550667acd24fda023fb61c2af9ee924103cf7f4702e59da726889c1ee0fd64fbbee694c5e5e4cd6d32611e96208ec66c474
- TLSH
  T1A0B0126623491238E2344884C4DB8D03D42EEE2053194ED8A24CD170188FC84015F15A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  crow(Copy 24).bat
- Size 95B
- SHA256 01416853f9ba35a80ea108be16c4633b3ddbb24c3c32b9de44d6298adf0b1711
- MD5 fa8d20242e8a97481ca4aebff18553a5
- SHA1 2704f4ca0350767730356f3c86cfd677a1902da0
- SHA512 5d330e01966e22e8fe60154d547e8550667acd24fda023fb61c2af9ee924103cf7f4702e59da726889c1ee0fd64fbbee694c5e5e4cd6d32611e96208ec66c474
- TLSH
  T1A0B0126623491238E2344884C4DB8D03D42EEE2053194ED8A24CD170188FC84015F15A
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32