35cdecccb8d52c5cb8785306088e590c9f8f4b656f1d99877f832fd130b3b5c5

Sharing

Copy URL Twitter E-mail

General

Target
Minecraft.Note.Block.Studio.exe
Size 43.3MB
Sample260817-289ataeb98
SHA256 35cdecccb8d52c5cb8785306088e590c9f8f4b656f1d99877f832fd130b3b5c5
MD5 78da383af0d3a0a31ba5a6f6e067ccc6
SHA1 580f8e48161b369f36ee9a19fff5ebe19400eb9e
SHA512 c94b19b0304a16f8bb73639b2ae1bce9342af408c9d41794f9aba89aacaabfc5dedf891b75ec2e0e8123f4e838b5af69cf239bca39d444fb86b2ba43831ea2af
SSDEEP 786432:6P9xR54hCRbVw7xDqAYskKbeTZxcmpMmQO9KWNMFiNssr/VnqjXIhXDd:K9xR50kBw9qAZAemWm/EW6FCDVn6XIFJ
TLSH
T1BFA7338267F4662EE8397FB23054BEDCA1DD89173843CA6B73A011E1A7F3407193656E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Minecraft.Note.Block.Studio.exe
- Size 43.3MB
- SHA256 35cdecccb8d52c5cb8785306088e590c9f8f4b656f1d99877f832fd130b3b5c5
- MD5 78da383af0d3a0a31ba5a6f6e067ccc6
- SHA1 580f8e48161b369f36ee9a19fff5ebe19400eb9e
- SHA512 c94b19b0304a16f8bb73639b2ae1bce9342af408c9d41794f9aba89aacaabfc5dedf891b75ec2e0e8123f4e838b5af69cf239bca39d444fb86b2ba43831ea2af
- SSDEEP 786432:6P9xR54hCRbVw7xDqAYskKbeTZxcmpMmQO9KWNMFiNssr/VnqjXIhXDd:K9xR50kBw9qAZAemWm/EW6FCDVn6XIFJ
- TLSH
  T1BFA7338267F4662EE8397FB23054BEDCA1DD89173843CA6B73A011E1A7F3407193656E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution persistence ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  Data/Python/Lib/site-packages/numpy/core/tests/test_abc.pyc
- Size 2KB
- SHA256 60f1d9cb5b602174f07d807392f89fd21fe2faa85324a365dfc90d6c4ab3cd50
- MD5 b52a35525258b30e39a12d039e19df62
- SHA1 275a74c7186c8ca0de8db6c793b4cd38f4ad9353
- SHA512 84f0dd2e1c7a3efbf2ef852cec38637e86d0e2f8af3afadfe924eac4c9fc4a0b204f457f35f974be4733fa11bbd84cc7392b487d4ae6ff949f1bb72ff34e0b51
- TLSH
  T14941D186828241B9FC35F7BDAEAD4116213AD1EAA799130701DCC4773E5A6CB65B840E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Data/Python/Lib/site-packages/numpy/core/tests/test_api.pyc
- Size 14KB
- SHA256 733a3cf5d9c3a7585c86524d7689c14e725f2120d8db6eea833aa49464b5deef
- MD5 7425bc1ed6e784c9a0c8cf27dcba0c4e
- SHA1 cb3a99cb6595e9a3821bc2d0ce89d3d984bb245f
- SHA512 1543f9e471954c9a111eb63285bb4f0c45383b2fd0c548cc00d6aeb47521a30ae85777d7f8c9d89142dc9bc4c4a4b1f96c0fec90007e2c44444e348939329e68
- SSDEEP 384:wAKUfMLH+NUJB7OKJdy7aTibTlmj8GcxqYvGmF:wATfYH+NwB7DU7aTibTa8WYR
- TLSH
  T1A16285C8A40A7A6FFC11F2F5609A07106133D3141706E3555E09A1BEAD7B2CB2D6779F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Data/Python/Lib/site-packages/numpy/core/tests/test_argparse.pyc
- Size 2KB
- SHA256 646ad952d9512b2eae4f07f64f5d283cf7a9dafda66fecab3637b1aef22b7a4e
- MD5 e182bbbd03fe39aa9a9576d9b1f986e7
- SHA1 ff56355d27ac8ada9ebc32a48950655863521e04
- SHA512 2b6128fe2b4d1501328e68258d074ffb26a9ef8b8e4f316174f1a66e4f442a207112a36ecae9d87bc70d7e3592cef6e000dd7880a73b4c586a3053847270ae3e
- TLSH
  T1E44175C364420BBBFE52F2B055FA76214331E1331B8C42935C78C1AA3F654060D72E49
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  Data/Python/Lib/site-packages/numpy/core/tests/test_array_coercion.pyc
- Size 26KB
- SHA256 e4899ab13f365ed02eec3470728f299ba7795005a4c2c73420043bbf7542d5da
- MD5 15c6be9f47188cfc07b85d909cd91f39
- SHA1 2ceebe8173097744cd6768b8008383232edf0466
- SHA512 d1ece35d949d907252c0f3a0b309addc04d5e502c4d322fb5a279271b3445a36fe069bc16163c1460268ac34bb052e4d21129c1f683722735c34d6d41339cef4
- SSDEEP 768:g2AmqXQPqnqqPq0Wqq8qOqqLqIqqg/qRqmKqcq9qq6/xqkn8qka03SqwqO8qzd2G:4mqXQPqnqqPq0Wqq8qOqqLqIqqg/qRqf
- TLSH
  T12AC2EAD9A09B7E7BF93AF2BC521E06009626C306015D951B7821D56F0FDA6C83EF61AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  Data/Python/Lib/site-packages/numpy/core/tests/test_array_interface.pyc
- Size 5KB
- SHA256 067881d001066e473ff3ac362397b49413278c8ebbae5a21abf8f5c552bfb98b
- MD5 d67e0692f13aee2ce68826464523f5a1
- SHA1 f0a5bb8ba9513349712713acf0e2e2740ebbbac6
- SHA512 65fc0880c8d9b624d44e0529310dc58114792b2dad61c1784de88fbfe7c151bfa5a7e1f97403b3481f670911846fa041bed5d944d24711ce1a1c2d816afaefa6
- SSDEEP 96:gFeTqD3nqHY5QGtK/g6ybDOcJ2Wr7V2f5Qnm4l7sKzCCRffxXnSbQ28:qx3nqVG8/Rye01ZnmQ7sgibv8
- TLSH
  T14CC1A4167E739D5DE4C2B6B3AB4B1A529518D02343C9000E3C9D985A1FD69EAB27C7CC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  Data/Python/Lib/site-packages/numpy/core/tests/test_arraymethod.pyc
- Size 3KB
- SHA256 7b090f5149f0e72750d5983a709c586ca97a587c3d058577b415ed9ffcfe8cc0
- MD5 b5bd5e9c08f965062f54812edd50904f
- SHA1 05ecc678ea7c5cebf83c60f40706236eca9a0e40
- SHA512 536fc4f8018f7a2d68b8ffdc18ba80a0fee1ab493344b88ef2f8d2d46ccfbffef71ff87a92b55194941af28adf9df46924c4a42ea4f9595649261bb91719f4be
- TLSH
  T18261B7C79D478E7BFE8EF275D0E6034217A9936EFB4AA613489C44120E427635EA134C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  Data/Python/Lib/site-packages/numpy/core/tests/test_arrayprint.pyc
- Size 33KB
- SHA256 21db9bb4789fd98e7bc1d1139fe2976e5b4ca8a087ca14deb9644abf798ec60c
- MD5 880f6705c9809d0b8d29163d6d9e7f71
- SHA1 d5c31818f27d30418830bdcdc6677cb795d40a73
- SHA512 b16c1b8f6c503103fad312da81bf1c079af9ede4b5a62696d3f549067174152668f9bc6322448f48ef87508cf24321be2657b8e201edde4f19285c538f865c3d
- SSDEEP 768:OLhE1tJcQG66W6Z6y1966bVSOFr5dhP0EkckMMfIlIwM529jqd8OStgpwg7AH3p+:OdE1tJ/G66W6Z6y1966bVjr5dhP0akMK
- TLSH
  T178F2A58B64C3896BFC27F270D0651604163AE26B779C931FB60DA85E6F4978E0DF018E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  Data/Python/Lib/site-packages/numpy/core/tests/test_casting_floatingpoint_errors.pyc
- Size 5KB
- SHA256 5a7188e9daed48134ab87f53120e78a988ec9dc97656e90b6ac1aad141759d8f
- MD5 2ccb68039282de7ddcfc71d6e13d7141
- SHA1 edfdc8ca7a0c50ab169e975c6a8839933749844d
- SHA512 3bf7015876bafa1d8b848ca222fb93a13ab8bfd6c6c23d71177cc36401fc330bc27bb85f2af1b4f50eb1da60f2e509c6314e784bde1b7f99856216f3e03c476c
- SSDEEP 96:govwj/YKi9UgzYdaieFtIX2HktjZVpD3q56M/b/ja:9IEzMeF4tjBDa5c
- TLSH
  T1DAB150C529124EBEFE62FAB5087C13615937EA9512C65037533D89AE2D0878A1FF34DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  Data/Python/Lib/site-packages/numpy/core/tests/test_casting_unittests.pyc
- Size 20KB
- SHA256 b61df0547db6dd6cc1e6996ee2f03d347f046988d12f54a27a1dabefd6307da2
- MD5 5ce97a1e0468d6a72231e8cdfcc3b199
- SHA1 73dd7a5230704c4397068f94ba75a70a2c74613e
- SHA512 7888b4b55b9c421d9c26569faf53f9274f31c477da63641af5d5372ded462b13b4b6463bb4f70caea7d9f4b1966fb04c9a0c91f224a34dbf3b4d51d4707eef9d
- SSDEEP 384:g4Db1HKLdFjMIfytAJvhsrhjcp9UrYaYum7Qm64KrHTWk/u8h8FZs:g4D5HKLrjHYAJvOrhjE9UrYC5mZwHThf
- TLSH
  T19E92E78001CA457BFFAAF9B99C5902744A32D6BF92A6D3027D0DC59D2F4638C2F3469C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  Data/Python/Lib/site-packages/numpy/core/tests/test_conversion_utils.pyc
- Size 7KB
- SHA256 611bcce8033df0b934e00fdf98539e906f6820ca910b34164d10b8543f6cb5bf
- MD5 9644ff970e57a53cb1d86c479b9cdf98
- SHA1 e399506943829e3c800398461c14968cf366c908
- SHA512 e21028ecc43e6e3911252d35ddee670c8d67a9303159c3ffaa13f60b6cc85dd037a5be22743174a6777adb8831447657c5756da96bcf420e09145ae6796a66bb
- SSDEEP 192:zV4csS8URBBEXdT747iwICntswhaspv74FCdQwjD:5uS8UBEXhU7ksR0chf
- TLSH
  T193F131AA49411E4DF7C7F3F8419A0215DB6BA266FDC82733561DA9071E15EC02F7078C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  Data/Python/Lib/site-packages/numpy/core/tests/test_cpu_dispatcher.pyc
- Size 1008B
- SHA256 1f63c090bc53969d3f0e8b55b4cb6d2b80cae9a71746ac8be715cd51de232805
- MD5 43fdbb051581ad30886d117554251d8f
- SHA1 6021ce2915d21ceebcd5df0d4829ceb20c8c1494
- SHA512 ed287aaf15ee2b2348bcd4226e7d32bc70e34a018f1685a74a699d6b46c58cc37570482f6286a492511377d09df26a22e453cfdbe59ecc21027ef75622a6b952
- TLSH
  T17411E191855D0321F924E3BAAA3E213B71F355B993AA4700AA45B42A4DDF016E234755
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  Data/Python/Lib/site-packages/numpy/core/tests/test_cpu_features.pyc
- Size 6KB
- SHA256 bce34ec9fbecdfa6e2d41bca60f842edf5b1d840eb7d76fad825bcbecc8e65df
- MD5 635380881eff8c30c780331a6d44f54e
- SHA1 03920decd3cb10437381883d23a70fa0868edfc2
- SHA512 d8f05e70b93fbd344590e668213c761bb4e2e425da896e26c6478f4fdd70135089bc0b2a385604981f63d1afdca3998b548e1afe04ee0c06c218c092f5d1902b
- SSDEEP 96:0XXBjPdLV7ugDv7rsccoOc0J/BeEZyxCPIv4OZU7razOZfoFN22BuDzPjLKxtS+U:0XxjPdBagbtOKE4x4vafFN22sG/e
- TLSH
  T15BE193D84FA2B681F76FF7BE001EA700EDE196D72F472113966DA4CD09842D8257E05B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  Data/Python/Lib/site-packages/numpy/core/tests/test_custom_dtypes.pyc
- Size 6KB
- SHA256 98a6f92a3dc817b1a3bcde0b65244a93df5f5c61d14fe4bcb5da510cb9f0e4fa
- MD5 b558fc8ec6a87e0d7a18fee2c549bc93
- SHA1 233e77403a8e9c590f9049a8b1b6c8f2442ccaf3
- SHA512 154a7007df59298ed4dac2173fd6bfe4220374225080a3ad4f54cd2b5d0de96a3773c61879e8d1cf3d583a0acf63f3bf26acf5fc5c1ef1b7a80704d2be171ec7
- SSDEEP 96:tXuknFgGKrJE5KnW/O6ORnG6iU1bp3qfXHQYQZonEeglpf+datulLLf2xw:tXuknFEFKaWGRnG6iCNqPoe4N2gyLae
- TLSH
  T1EAE185E40803DF5DF961F4BC98590360E239C3FE53683916BF05A81E7FAA2DD58A46E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  Data/Python/Lib/site-packages/numpy/core/tests/test_cython.pyc
- Size 3KB
- SHA256 b30e96e47196cf22f3bf7c8188c77db4501a5dc08c07cbf1975f9c3814ca263d
- MD5 da19a2a8f12404f3e43526d5dfb9db2c
- SHA1 593bf790f0191b91f3ebf1a4edb7ca75077e002b
- SHA512 ede0cf611cf3f300947608515937ac706d9e89202c494ed06fb6f81599cdc36c0a4ee11a8913eee19167d44ed7897435ac7cd1ce4d7e0fe1abbcefeea1cc0ac9
- TLSH
  T1125177A0CCC29939F88CFBF8052E0E119715E61873DE74036301C1EA1E7904D59A2D5F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  Data/Python/Lib/site-packages/numpy/core/tests/test_datetime.pyc
- Size 63KB
- SHA256 fa9181109fa273833d988a3437d0fa35575914181e8f854eceedb914a0267e8d
- MD5 1ef004f590be63440283ee78b7c7a5c6
- SHA1 32f328924dace13eea0a93ae351d9a480e085b54
- SHA512 2969b373c637e33b09f06b5a859c81012bfc0e75f3acafdacd7ada379ac338010a7a44dfe89d99e56844f99d008a08c8a4cbf6dd9fd1052a38b729d2ef51ac80
- SSDEEP 768:GguSmdf4DrUsMreUOh9Zur29oC5nrSVgLNzYWr3OtaB52Hr0a7pIRd55gnzwjyIc:4Smdw4wMInCU++52cMzwjBerTJCPK
- TLSH
  T17853B54A98A1C56EF879F2FD486E1B490623D24E3784B38B3404DD4EBD10B6F1CA62DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Drops desktop.ini file(s)

Enumerates connected drives

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32