3d5a0cda5722cdefdceb86e511e191c1c9d147c9aadf964f792d63e5aacfbeb8

Sharing

Copy URL Twitter E-mail

General

Target
HWID Spoofer Final.zip
Size 10.2MB
Sample260816-jsc9bsshpa
SHA256 3d5a0cda5722cdefdceb86e511e191c1c9d147c9aadf964f792d63e5aacfbeb8
MD5 c20d2c8ee0bbd890999aea5df5be143c
SHA1 1cab8a73e8ed5a97020433968c677dff28e83bc1
SHA512 7266c093b5abf9dd499ac9dea676eacdb7ac632e9cbab777321c23a066a5f2f394e742138e4ee494200689ccfba1021c49d55e812d62df7ac2c767a652fbe010
SSDEEP 196608:hc3hXnsdFvEOCwiDed/xvrqHpp5lgLn/lXbBC/nWGOUCD:gNsL0wFdEpvlgLn/Z6W+CD
TLSH
T1AAB6331602F0C532C94A2E76958C27E4B37A2B7C02F156AD3A1AFDBC358F5F5452AEC4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  TraceX Final/Run-TraceX-HWID-Spoofer.bat
- Size 6KB
- SHA256 37af4c4519fe8fe3331d56e74ff2be57c09a46041b32c5a3233acc243b456945
- MD5 4f98523504c362ef51a4c82768e8b51a
- SHA1 8d3c001925d58761b5707f8a10d662d7b77416c6
- SHA512 95baf291c47eb91da07ba20025df0c93b54e9b06bc1afd5f2090a991ade6b50a88083472543377d1b8f6c55b50c9e0d8ec231735114291b02b5997f2972dbbfb
- SSDEEP 192:H55Iq2WQKBJ+mglJIqL1WRDK6DFD66DFOQDF:Z/QNPGe6pW65OQZ
- TLSH
  T1A3D12122342E97760ABED52884250069F55A62CF61085EFDF1AFD1781F38384DBFE5C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  TraceX Final/scripts/TraceX-Helpers.ps1
- Size 929B
- SHA256 06cc3e5cd3fafc24da12db08934cb700fceb5ea61b448b94f0aaf2e656c0a125
- MD5 373620513b4d0f6f687841413ce2321d
- SHA1 3e36e0f9c4cd77375ce405818da04158fea3cc57
- SHA512 873ca999d7b2c99ab77269e440df0af9da9f47f678f326e71ee1c5d1e6ed53374defe3dbb1fcc91b6aaa5d4d85e9cb36c8e1138e9be7598e9f7723a7bc6b6a84
- TLSH
  T13511C058C240DF5C5CF71BE43446B43C89DC012BF2186A6CF4DE53D16B7C29C5216A4C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  TraceX Final/scripts/change_disk_ids.ps1
- Size 18KB
- SHA256 1f8d5f2b9f325c5ff76f2dee89b58e87a14a8a63099faadf67dc8c4e9c79b4f5
- MD5 2e9153edc202d577555609c1d85c25b5
- SHA1 91826b9d6ecfe05c22963137ae77a43e451e33f9
- SHA512 8c70b8caa9afdd7ecd2fdd34216ee4e24b246042493ab48fe7e4625b8b567d47cd896121cdeee86aac6a184d7f5a6c44f2032e49a2ed3630393610dd5c7cba5a
- SSDEEP 384:Efwi30WJSZ/RUxpVanrk5cGhbdR2DwXuV:EfnkWJSZ/RUx3agxHeV
- TLSH
  T19F82511DAA086D984AB35FFD89C36620FC8700BFC19B7490F95C81D12F7921ED255EAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  TraceX Final/scripts/change_hardware_ids.ps1
- Size 27KB
- SHA256 45acb80d0e7018581549dd2151c9a5e7fb790010ada6cc1bf68a1bde2c6874e4
- MD5 8933162333b954f8b77cdc3899b8b9e6
- SHA1 71209a7de51692f06e19553b73c478c991572848
- SHA512 99645c9f6caefc60545ce4bdbb50741fd040a0485cab9b2c88a167ea118a2cf996d218113af8e181fe6172e865f79827e3682d550d3a9db3ceffb8f9bf0ec3b3
- SSDEEP 192:Z4E0fUddycoIrI3zJumighSP3Pl2IA9ZuMYwK5iQS5iQ4Z4JoiQKCoQoMR5RqRoz:zGIgLt62fYfX1dXSxWOxk
- TLSH
  T1E8C2132CF945191E565300BE0404A204BD97917B91AD6EC0FA4C81E47FCA73E9B72AFF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  TraceX Final/scripts/change_mac_address.ps1
- Size 33KB
- SHA256 ed8decb95bca85a67a7b561c13bd620aea4435f6eb0f7281ecb9c978c659adc4
- MD5 7c30e9dbc601ce74f051783907893ce7
- SHA1 145e8b26e07f995734cd9f9a0a9fbdcb5ba18e07
- SHA512 35487cd0ad32fad87bf5898568339ccbd778773507d6e9b38557568916fc42e824bff2325b8f9be8261caf18f7d4e6ab69c878e51f04b8db07d21dbf053a1d13
- SSDEEP 384:vQFbkas42hanB7OznU4zgvBYAdqLZlAa9ktBfm04yqRXuNU5skkAKnOE7vFxcQU8:f4wsGuPLoa
- TLSH
  T1DCE2FC1DAD49155E9AB382BE4881A104FDD2457B918F1DC0B50CC0E87FFB36E8A26DB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  TraceX Final/scripts/change_monitor_hwid.ps1
- Size 35KB
- SHA256 96dbe729cfd2342479c2f701a9bb579bcf28f18970fd2d8c9790b39c54ab3e78
- MD5 8a64b6da7004cf0d74de77f82f0ffecf
- SHA1 544ad208d462a0fb5abd0b7a5ff739106a0e50ee
- SHA512 b61f2ee03334866d5b1978ade865ad078658a187c165c54544fb12ea4e7b42c25527a4889bee2652d3d2de7ca71b239392a3bffe1f676710231c7fe7c334fb1e
- SSDEEP 192:T4ERilehRb65VQiAGtvU34/n4nvDorldfTUifRQwNEyTnEOPVUmXxuDRCjBptcn6:EkQUiAGqI/ckTfTb6ViV6MjVcRM
- TLSH
  T116F29A2CAC05051B16B3B37E08429614F996452BA29B1EC0B60CD0F47FFB75ED729DBA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  TraceX Final/scripts/change_registry_hwids.ps1
- Size 14KB
- SHA256 bac1e6d032ada2b0d5dc5d96205f3b09e9bce2698c2cea7655e7220bdd5bd471
- MD5 47a5eb9db7b6329b47cf0837ca058ec2
- SHA1 a14df46167467a7186b441a8783a0ba2972d1cfc
- SHA512 bf2bd4445a5b42bdff0cd9c0b96c0879a159fb62840d5a7559daf66bc79e94112da16b58c03623c224c5091da55b7f876d3c4128f9ee37cd49a489711bccb03c
- SSDEEP 192:EL4EQDo8qxg0Beccd3gfq275UYtYMhLiV3tCfvfKSC:Ejnxhec03KUmYkirCi
- TLSH
  T13C62531EAD8E011771F3573D4AA15124EC87417F922A2EC0768C80E87FF915CD6A1EAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  TraceX Final/scripts/create_restore_point.ps1
- Size 3KB
- SHA256 6c03eaf50c6e371bd73c802dac178f90071ba4061cf05106cfd94a6017b67b3a
- MD5 ff5f49ac8f6047e9d084035065841c06
- SHA1 cb5f3eaf9b1b7af0898245cadda3257797ee902e
- SHA512 b88004fce63a95be93e67cd15d649ae82b50cd291d17e06a9583a8caf7743bfd4f2913cb36c19561672f884fcc3ed568045818fd728a0cb8682bc14c5c63fdfa
- TLSH
  T194818418A904721647F34B2F5959E114F81E003B538A529078ACD458BFF07AE4B37FF0
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution ransomware adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  TraceX Final/scripts/hide_peripheral_serials.ps1
- Size 24KB
- SHA256 81ae14285af2a980166306f6a70b951d24b9713b5c75f7ca546540bbd3c0eb65
- MD5 e49d58c9df1c9fde9d11607a72cc4639
- SHA1 cf553e3964b943afb272d0b878bf85a35b2e6d1c
- SHA512 9ba67566732a9dbc957734bbcfa93fbf06fcab0174a72a43568674faafd40fa0cfcbb984bcc0af47a59af50e95e297c26e031bc9eecd086a69bf7170e89390a1
- SSDEEP 192:424Efv+RwCV2Bgc2OlDsyrfzkB5mJzImorzg6IsxZbtMDEv8tWk5Clk8PyP6Okzn:4CIwE2BKyrYB5XfQHsxZtMYktWfdmc
- TLSH
  T18BB21E1DAC05492E06B3C7BE4D919114F997403B81D61AC0BA8CD0E43FF671D9A6EEFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  TraceX Final/scripts/setup_vpn.ps1
- Size 28KB
- SHA256 36f7cca326f67cacf24d63facafa92e4300527946b590280da30e99e65ab4752
- MD5 56fa01e2df8c9952a5c18531cb080d88
- SHA1 4ec595d5822d9ee61cb0d3c695b63c98a5a65373
- SHA512 acf641ef78b5c0ce372a33985914b35edf3639abca397aa62d95f64a577cd6a2e33703c808f0964e68d3bb3c0fd6c95a675f7fb913da5764679c9108d1a1afd9
- SSDEEP 384:4XH2dunqF8g9Ch21nTfViwZNJ41ZDaTcaQUJBYxt4sdh7EarMjKwjlecW2z:K2JrViY7qaYaQUsh7Wleiz
- TLSH
  T1D7D2C71E9E01172EAABB877FC8406064FD4A553B038A1582729CD1D53FF052EC3B9D97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence privilege_escalation ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral19 behavioral20
- Target
  TraceX Final/scripts/tracex_cleaner.ps1
- Size 12KB
- SHA256 4e1d8acd1573d5aaf3f0a3ba2643ff4ae2c21198bc6a5088d6676a6c0646d4b4
- MD5 a82c7d9876943fb05ef4aff598db1534
- SHA1 50be648a119eee18fbf7aa2729ccfd656288b90e
- SHA512 c5ff1a2a5949c130b1c99cb2cc65a4098c6c4f2ec8f5d159c0c3c1467167999e63ec92881213ffc16c828743057d1a42392ae505b95e9a215c7062e3351a7d1e
- SSDEEP 384:dy69x12/x5uR/xYNt1kd2rpFVtses+5neOK+ZFSKkjgAUpJX:9iCc1eOK+ZFSKkjgAUpJX
- TLSH
  T159425F0A85486929C6970A7F5942E2056BE591BB534F2DE0B94C817CBF8271DCF32DF3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  TraceX Final/scripts/uninstall_game.ps1
- Size 4KB
- SHA256 5a24c4f14337ed42ee7f332ae660ee3f67015ac02f7c715e9c81d9171439e0a9
- MD5 2070d2561ba7261571524153f6762160
- SHA1 4a804edd1b0e75a3979036e8a3d870132a0484c8
- SHA512 6ddc8760efead4855dfb7b4801b7c07fcc7ce8142ed74a06625734a26570c854b9bacfda4eb32f1063d7276ad73af840114fe12132d8529a3913c91e450ec025
- SSDEEP 48:Tu71aYmPROiy3vDF8Q5qGsb4c1l2840/s/mDObKLg9BTzsfjpqw+3/GYl1hTU1FC:qhmPEMQ5qB4c28A0O1dPJ5UQTMd9G
- TLSH
  T1EC9111087D0522266FF3477F4A52F418FE46A43F424A16A0759D80E47FBA06C4F66EA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  TraceX Final/tools/AMIDEWINx64.EXE
- Size 455KB
- SHA256 13037eedd91f9313ec0d807947db65c639642e5ae6497e87d12fa6d19951f78e
- MD5 9adfcdac59db3286690c7eede8da2528
- SHA1 0b54d251438a634bd13b49a1f20587cf03d4598d
- SHA512 fde1700cdb4212593ec2733944a169c7d02f436ca6831719a33482fbfd0be289697c9aa6ce7ddfb6c245e87952b35416929bbf69753d21a24197ac6c2d1243cc
- SSDEEP 6144:PRx1SY2XTh/Fq+1VU1/SznTh8NUc9v4/nOmNAFw+lgBwFejOLlC:PR/2N/I+rUqE9inOmNAFwa/TQ
- TLSH
  T1B0A4084AEB5224E0D876D1B8C981521AF6B0BC7847349BDB729C41090F76AEC9E3DF58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  TraceX Final/tools/HWID-Spoofer.ps1
- Size 12KB
- SHA256 03d965268dc89f7682ddccae23fbe71f9b267b68b30f6904fe3fb2a348b3e02f
- MD5 006f527f082850b8a0466b89f51cce16
- SHA1 122a7470708fdf9e560055ee3489396514520bb1
- SHA512 df3933190d7d78c92c6131a9b713c79f678945158872c6acb2d4bd4352a46c216e383fab24777c91311697f5d572958d469d9cd547cd8a04e473f33333ec1202
- SSDEEP 192:p54EonSIV+ZYZ0F0HewZVRxZ1YnMZngWZUZYZ5iZ6CBZ8RxZdYnMZtgWZO2HJgFG:uVImS0+w37j2mri7BILBw2pl
- TLSH
  T1F352FF08B948256EA5F3577F89819244FCD6983F818A1A80754D80A97FF137ECF62DF2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  TraceX Final/tools/OpenVPN-2.6.14-I001-amd64.msi
- Size 5.5MB
- SHA256 19bca902826ef0dc9a6cf849297ce43ba8b2844bdb913c37230308d3274c953c
- MD5 1e150b4507fc951c8a23b08b85236cd2
- SHA1 3f6980947c16778efb3126193726c038453c85d6
- SHA512 2074822532d38e94c131ceb3b4b7a01379ea20b5d6e3fb85a6912a586b8e6f1ff5a4973c200087ccd5ecd17727acef2d5568e6afc9df392da5c1f1978b4cd3a8
- SSDEEP 98304:fEnzYKCLSBI0lGIOKv8k7VHTB87GnJ6tEGb7MrisWnB+A/yue/bjBe:z/LS9ZzVV87G2hbWij+xB/Re
- TLSH
  T128460101B6C10462EC678230C85E925AF2F27C5117A0D66FA2DCBF7CBF3B3A5526A751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

persistence privilege_escalation ransomware adware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral29 behavioral30
- Target
  TraceX Final/tools/RevoUninstaller.exe
- Size 20.8MB
- SHA256 17fa74b386cd22e47ceb8f48b958cf99865985ec6bbb1786f1c62fc3f804bccb
- MD5 a48a4f7ced6fb636ec62eca2eab90678
- SHA1 c26e2d0f3d984187a1a8d05772dae7f243a7f84b
- SHA512 248fe9084aaa7e00865699fd089060348a14d803e5bc121f3fad3b41693f8620eaebae6805a9ecdd547211919c831ae0521e360b3f55e2b551fff6345243c50e
- SSDEEP 196608:4RYn3XUAe1ELJhbmWqPWpyR1pOIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIef:4RYn3XUA/JhlqPWpyR1pxf
- TLSH
  T13C2719B2DA1584CCEE6C6675CE1D89FDDEA26C1AAFA089AF41043D11ED732C09D3D24D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Drops file in Drivers directory

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Enumerates connected drives

Drops file in System32 directory

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Drops file in Drivers directory

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Badlisted process makes network request

Enumerates connected drives

Drops file in System32 directory

Checks installed software on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32