26f735cbbb1257be94e6d01656a35bf66a8ae9c34868548d69ec5cb588f9f916

Sharing

Copy URL Twitter E-mail

General

Target
18082026_1527_01072026_TrainingAnnouncement.jpg.vhd
Size 14.0MB
Sample260818-sv64vsvema
SHA256 26f735cbbb1257be94e6d01656a35bf66a8ae9c34868548d69ec5cb588f9f916
MD5 7c8cc61592303bb7af1c4d2cba12ee48
SHA1 ac4b40c937ad7698d9e117c05f5f986ccea92178
SHA512 5695be157a567d4e6b395193e2a8da0b65197d91cf214c289bb3b133713ba16803c8752e6d558fb31037570cfce4976298be7161d87a5881ff9ba89c9dc0da05
SSDEEP 98304:f4kEVsHzcuJ+/yvyE7kFl3vQUUrVFmnBW95w:829PKEouB
TLSH
T1E6E65A07F84155E4C1ADD130866682627BB07C895F2127D77B60F3B83E76BD4AEBA318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  $RECYCLE.BIN/$I4CCXNO.pdf
- Size 66B
- SHA256 000f29557f66d16c3938c58b6660ab55dd2232748f786d85653b789b6dc3b37f
- MD5 d4b4386c7b520faf2bfdb3ce3ce3d253
- SHA1 539e7c65f7451d84759af98eabb469df723b1392
- SHA512 2571eb86e42cb36e235b2bc49ce3191931711edde4f2e11deb095f8d42a2d23a72a64ca8be9e9e8bd52c2e4e7ca74e9e0300239c691dc3e36a43636de00a99a4
- TLSH
  T1EFA0021825148106D341943B4645D6D156B80EC0D4501F4045B31A651D0F395A57AF2D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral1 behavioral2
- Target
  $RECYCLE.BIN/$IC32JRY.pdf
- Size 66B
- SHA256 53246b9a870d89fcb601795d4131810944eb4928b0cc42ad61714c3a9671f474
- MD5 2d2188b11c95724fb402bc532ce819d3
- SHA1 b9af689309f5e0846b1accece95b012bebb93128
- SHA512 27f22b4e8d2b4cb24d02b131526ae3b95c6611e317b401e713106bfc111da3f0526a522aefa7aef04fd3ca32f5612c27559cb9d2a700d13b742390907c2beb9e
- TLSH
  T186A0026C22049102E70FD07B0945514151244ED194500F4041D21A24080B255F435D1D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  $RECYCLE.BIN/$ICW8PHQ.pdf
- Size 100B
- SHA256 4078526fce440ca93c1129977968be23b17391bd8ffc81905562346e945ab446
- MD5 9a3d4942beea7e5b9bf265fbc8901fc7
- SHA1 4ad3cd75b8f1d6b038a68f920925344d5f6e40ee
- SHA512 58f44d8d1be48fefb244a774928fe1f4734690d5639e053e9106fd8197e09c8f9899ebe674b7deb921cf0b2383f49df3a4e1075b371dece852bdf0c119ef91f7
- TLSH
  T12FB01130B3080208FBE3023F282882002AABBCC20200AB08002A3288883A0008830A32
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  $RECYCLE.BIN/$IETCMOD.pdf
- Size 66B
- SHA256 fb4b622dc79c59a5fde9501847b7a31cc2a1c13471da4f93c8f30504f70e4613
- MD5 10b18ed6cae6bb339a7a794e6a823cdb
- SHA1 52de0bf51341694483205cf3d18daa711b47ec05
- SHA512 2884f29d10267570a8512d1644686906ad69ba473e0ff62437f9fc93716fcda47d43ee20a2a7802cfa18c97ec9e6d2212968834d6570ba19b514aa5f3c861a2a
- TLSH
  T174A0025935010596D34590375445D7419B646EC0A4940F4212B71B250D0B679B438D1D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  $RECYCLE.BIN/$IHZE7DR.pdf
- Size 96B
- SHA256 d4112f0c72c6306262d539d557c21025b204651fefe9f36f5afb65cf054d97df
- MD5 2827fb1fc1e4b788e54a4d12343b3aa3
- SHA1 f9e1b1eabdc4ff73ad5b8014c1373813f74b406f
- SHA512 ba3507ffbf47be9331d6cc6feb1fe4128439711fa64979c9ec46ecb2ef14d16c3b8583d09bbfb17ceff3806cb4a0d5946459c8fe6d3ab307c4fddc8848049d6b
- TLSH
  T125B012101CD40A84F2730E374539110106B220C90030430C8131801B0C52A40CC30511
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  $RECYCLE.BIN/$ISZLWN9.doc
- Size 100B
- SHA256 44adda8b4795dafde9d50d27f1ea8945cd4270a7e758a50253eed1695f97d78f
- MD5 ba4c46db1e3cea8c709c067843387bee
- SHA1 8e67c4994e1553fb1fec4044912d3236733d2dcd
- SHA512 93b19939a85b84e05cb7003dac5917c2012457744f1c9aecd79c6d7432da55a332e9f532a80ca1b94a4a7c502b4ea165a10b6888a077aad4c53c836f951bed14
- TLSH
  T197B00212F6D61A08F72B1976187981680762B0E16D9B8F0D444595540CFF63C945461E
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  $RECYCLE.BIN/$IW9D1Q6.pdf
- Size 66B
- SHA256 a4dfafa1b05fc83bf3c3f4a64178383f64a414e830585739ec56798593db6efe
- MD5 a0096cdce621fc3b76b9f03e090b5527
- SHA1 ab86e57d2ef04f0ff728faddfa926e4ce133470a
- SHA512 e8702e1dfc2b7e1e1e3bcc2c29b77898091bdd2f32e2c06a42cac2185db4507a311051166a50d7ccf8c7a4417fd90ab7e194ae75dd69c2023e237e4bc3d4f54d
- TLSH
  T15DA0025929040156E741D5378445DB4295650AD194911F4114A31635284F62DA03CD6E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  $RECYCLE.BIN/$IZWM7BO.pdf
- Size 92B
- SHA256 c166c8fc5ae937d027f63b17a4b75cf13e5c63ac58685f12dc33a0833c2c0945
- MD5 77dcbcfd64232e2cc978ef71376974ca
- SHA1 8ac53acab603700a576ba3a71e7504a88f06fef0
- SHA512 8d633993db205aadb72ded65bcc39904103bcc26352e4d3abd2d639fad64a5240036b8ec347aacd95a496d189df05d209521d7dc0331c5a8397dab898b2ef87c
- TLSH
  T12DB01275215007C0FBF30733780A440111381CC0081447123051060C091A9008430637
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  $RECYCLE.BIN/$R4CCXNO.pdf
- Size 68KB
- SHA256 9cc22ce79a77791a1704fed63e23eb9f3d986ee62971dae77a1ebd0623d7a44b
- MD5 da9ba15a1e1a80b91332ed0c049e84ba
- SHA1 3fddaa88a9b34c2826ae3bc0976beb1dbaa66bde
- SHA512 8f1e043d3c011af7f144e6202a08b035d3e78198996deb0741833c304d669565e1969a0b76283045909ae29dd4717f140841233d63c93727d7b9ef72459182d8
- SSDEEP 1536:+x5cXpRYwnmdyJvnzEgLDMd5hz0uBEp3PQF1449TDZ6PP2xycP4M:+GYMmdydngc4BqoFGU8PuUcB
- TLSH
  T1546301566BE7BD6DE02AACE7771E11080EC9F725B1E88102201C17DD6619EB2DB3B64C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  $RECYCLE.BIN/$RCW8PHQ.pdf
- Size 124KB
- SHA256 ca3d1ac2c5cda317cea112fe4f20495d502570730c4a10324b2a26de30dd36c2
- MD5 0851f83db1d64724c7c6df98aa482198
- SHA1 3fff47c7031ed35cfc4d26954da9a2be725f243c
- SHA512 b08a0894ccad96d5d0240c53a15a8e399fe73ec875af13fda24bc07d0074633274d04b744da115749d00c08cb61eb46708adc400347a66440d8e9e4e875a925d
- SSDEEP 3072:kUa2m861CLO7cEgOnPdhP/5JtT8b8+cgXHfMjBeq7mL4:kU961CLO7cY9JqbFXPOv7mc
- TLSH
  T1DAC30219C589DD8CE694D143A33F6396E7D5F19B72E822C3201C47C34CC5FA9AEE6809
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  $RECYCLE.BIN/$RETCMOD.pdf
- Size 265B
- SHA256 d6efdb4bb57b274b2bd6fb2d3381f37351d4340e43f8d74bf75df8d402a167d6
- MD5 656e9e966745dee79d67bcca757dc637
- SHA1 9be807bce0fdddbe0bdde6ed76f6b31a214901a0
- SHA512 3b01cb92b5cd521a4e501f072afb737fc8f0ba83dafda510e31cb0799c9fa56c6d0f41791e0d38f4e43811e78613e38f550e6a8a589da69b6dfbe43d522baccd
- TLSH
  T1EFD0C700E8462CCC01B2C907EB08C6223B103030428FD88AA2AF8DA30006FA383C3A57
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  $RECYCLE.BIN/$RHZE7DR.pdf
- Size 83KB
- SHA256 2c16a5e3c586054351ef536a1663a1fb1572a30d89d562ebd03030e83d851384
- MD5 2592c9138868d163388d912dad2b3d2a
- SHA1 7e95309954dbf34bd54c515d3495f07c91eb94bd
- SHA512 adca9351416076f20a1ce9071172d28bbb322b31770e30184596c699d54f54a397f1c0f7bd97337370a60f8e80e56d1815cd33a78a8d8b48fc1f2adec7467a6f
- SSDEEP 1536:M6sNyvlocR+gA4bL1M3AQ3Zt9EOyW6WIgke/KcJypOjsF/FgltHlx:MAecR+41M3BJfTl+gke/K1OjiK7Hlx
- TLSH
  T1AF830227ABCAE888FF37CF62D356C2284799F07101E061AA376E054F0B59D095FF6601
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  $RECYCLE.BIN/$RSZLWN9.doc
- Size 636KB
- SHA256 b1fd6a1cfa78429b3bf5adf64f69d35998f54577df486b2a1acdf854d11a12a6
- MD5 8a0e322c1ad98dd417a6365e0f4d72b9
- SHA1 73c60765387528885361e2e1295c32bac58d678f
- SHA512 2dbc243c972dc21995b36c4802298ed768ee5f30f8823acee0ee1f22537553f7b589327240b2da309be175b03db52618caa492e5470d7c7b5e025c6fc56c09c4
- SSDEEP 12288:KIm/l88kOmWRN7aiqIJ1aq8jX0dltioQwbsG63e0rb/TKvO90d7HjmAFd4A64nsP:VSFxxNrqIJ178jXWlQwbsGp0rb/TKvO9
- TLSH
  T157D4E647689550F8C1EEE274C62AA213B97130A5073837D72FA146F11B67FF96A7C328
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  $RECYCLE.BIN/$RW9D1Q6.pdf
- Size 53KB
- SHA256 99ac1687ec6a0435c36f2094339f6254a5f1664aaf4e950afecd1d742a3995bc
- MD5 dec6cf49ed41d2f976deda708309e730
- SHA1 1c921cacad70874ef54d95f6c7de8a54c6a2ff4e
- SHA512 f10aae2e0cf5285709b8073fb6a054829438a554405cdd156be83a628f96bf550d4deb4aedc49380ab0729b7124ca513e505978b202176808f4bdee33684ebd1
- SSDEEP 1536:NPFykSGbNGuyFhtV82F2Qy+8Hb+owMikE9G/6kyUeNh:WkbbNGu8F2Qy+8H6RMN9iMeNh
- TLSH
  T1F0335AA8E73EC2A8DC911915A01C3AE687D681D65A1C34BB6C90CFCB2544E15FD31DFB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  $RECYCLE.BIN/$RZWM7BO.pdf
- Size 265B
- SHA256 d6efdb4bb57b274b2bd6fb2d3381f37351d4340e43f8d74bf75df8d402a167d6
- MD5 656e9e966745dee79d67bcca757dc637
- SHA1 9be807bce0fdddbe0bdde6ed76f6b31a214901a0
- SHA512 3b01cb92b5cd521a4e501f072afb737fc8f0ba83dafda510e31cb0799c9fa56c6d0f41791e0d38f4e43811e78613e38f550e6a8a589da69b6dfbe43d522baccd
- TLSH
  T1EFD0C700E8462CCC01B2C907EB08C6223B103030428FD88AA2AF8DA30006FA383C3A57
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  TrainingAnnouncement.pdf.lnk
- Size 1KB
- SHA256 daeac66441b88ba22806f6617058a2dbf1ea0ddcc6c94f291542ea853ac6f9d3
- MD5 a204bc8249df2b64dfab8181172c25ee
- SHA1 9216fcae1736e8ff7cbed130677a52e3daf93dc1
- SHA512 1f1131195fb17a88c04876e1c4c64cb640d5cb2aa5bc54f676e7d14b09434a1b388d1278e0d624685b42a05ffd7ac78f9f323fb8d67d92178b77d4a53355d8dd
- TLSH
  T11841124C6559E631E133813758D7C7546633BCA1DD02562721B81D1E6C73302B274482
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware defense_evasion discovery execution persistence privilege_escalation spyware trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Creates a file in the Startup directory

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32