0a4cbd909406189ef48db731597bc67847bfc8554189c8d9d7617ccc5dddfeb2

Sharing

Copy URL Twitter E-mail

General

Target
0a4cbd909406189ef48db731597bc67847bfc8554189c8d9d7617ccc5dddfeb2
Size 11.5MB
Sample260821-j73grsae33
SHA256 0a4cbd909406189ef48db731597bc67847bfc8554189c8d9d7617ccc5dddfeb2
MD5 33d8f40428472ee6be428db57f7e8753
SHA1 407948b5b25754d1de1a36b0ed4206dd36ecf17a
SHA512 8390102aa164de50a126eb70bfbd1d9d2890ca3e5d576740a93c4d23988158b688d1b760a0b64b4af555de5cc3219bec848c1d1dbd0b39d3ddf4108598161bd9
SSDEEP 196608:GbnYHqiRQk3sQ0LsQiqRk5arVuFG5yK02YA1tWjr0HgOKGsOgx9JGpTuJdIqO02n:qnYH9R+sQiqRkISG5D0etWjrAgOKigbQ
TLSH
T124C6339AAF08D305DCE631F8EE578EB9E0AC0451BCD6EF250EE68879A6C41F150C7794
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  WebOffice/WebOffice_Setup.bat
- Size 2KB
- SHA256 847cca5673092c8f4eadde8bd279fafb8a9e6a59349ac9ade852678cc10fb7c5
- MD5 8fe8aa51215b9d7e60041f1ccba27fdf
- SHA1 36b0df6778e35ea9322579461da24830c70bcf21
- SHA512 2d02cc45985275e8023a612ba64330a95e67b63399dfe17eb0a131aa4d27bb0752be9a4f68f12b0bcf8eee56bda15eae0d0a24f43354aee8b3434d1039fbcdb6
- TLSH
  T1D851025B896B2013D8C9EFB09944185B713ED00990B977D43617A0B8557FAC783F5BDC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware discovery execution spyware
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  WebOffice/ocx/WebOffice.ocx
- Size 1.6MB
- SHA256 6450d632d6439314c6800b6fb74aa88e9543b10ba3579bea551ba23a7fc6460f
- MD5 c5c8f222a27fd172dce5f54c95e86e00
- SHA1 967a8b35e697b95df0016973c21fca5119bb6f09
- SHA512 e5c151819a56c7c1865f843e27ae043c31c8072153c614b32dd2c6da2eab37433551b880f466b51aa636f0305ed46439d99eb83279a32ef2f15a8059cff84629
- SSDEEP 24576:FnZ+jdyww69uTs7KQ0hGoLQ9rSc0esnNGsPEIrNQipDyLvFqGfYz:FZK78AEh6pSzesNGut1yLvFqEYz
- TLSH
  T12F753A11D505D01FD9AB02BA4E7F721D615CAEB4130162C7A3CC7E6E8BBA8E2793584F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  WebOffice/ocx/copyweboffice.bat
- Size 1KB
- SHA256 9a1ad8d3fab2a45b754865b5b076df0362e6fbd82f2f426cf9b835beb995b307
- MD5 69bba67846f58b1ddb07f70f2bf96636
- SHA1 988daad44bd9ddaadcfb3ba2572cdd1750280328
- SHA512 b0566376f39bac23b6db91044ad3eac2fe4cd7f2a3b7da5cf38e41bc113a421b698c58183ac829904038820a4fdc6a293976b125aae5d6e0c54c94aa97c6953b
- TLSH
  T133212615495B2116C4488B7579119DAB723DEA87905C37D0280FB0BA257BC8791F0BEE
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery execution
- Loads dropped DLL
- Drops file in System32 directory
behavioral5 behavioral6
- Target
  WebOffice/office/certmgr.exe
- Size 58KB
- SHA256 8a830c48c4d78159dd80f4dad81c0bebbf9314710026b1a2ef0ffdddcb24b83d
- MD5 5d077a0cdd077c014eedb768feb249ba
- SHA1 ea2c62d69a1f6b9d643fe16319ec7632c9533b3f
- SHA512 71bf48dcb6916a810f63710968894b431357aa694aa169067f567cc82b8e4ee732f581afb85b256e5c5a9d15a8b7b5746fa6a8b4127b273feb5b0e03e91b607a
- SSDEEP 1536:/RQvLjWiALqLkHbp7m8GYT3WXs39i4zv:/Vz2Lk71m8Ge3WXs1
- TLSH
  T185437201A3F98119F6F3A6769A7297248F73BD505A34CA0F23E4404D0EBBA59C971F27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
behavioral7 behavioral8
- Target
  WebOffice/office/npffax.dll
- Size 213KB
- SHA256 ee49ccfcdbd941d661134ed5ef32a85e9c9cd1e7797bcab1fd5c0620244c22bd
- MD5 a0f3ca78e5385f3860b38329164574af
- SHA1 32baeabfcabc1b2b14b2578002a0406dfc5a017c
- SHA512 49c25338247cee1a2272330afaebc14a17b58af586ffbbec5408d8a5f8926a097fefb0823e3e9fed7fe080f1b2b89302a056122382f5307f39dcabb107b4982c
- SSDEEP 6144:/4KuXj2EDBlyg6rx5Jk7dkcyNePTIdsxePm:/4KuXjryg6rx5skcKePTIds
- TLSH
  T166246B213791C17AD2CB22308E7FEB69662EB5710765C1C77BA88F7E5D603C26A34217
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  WebOffice/office/weboffice.bat
- Size 977B
- SHA256 085f00779b2c6ac55f48cdedfcf037efdebb7686767733f7998ec21bf3473a3f
- MD5 82b393b899da30d777fae8e5f35e2295
- SHA1 eb1248a73af36931af3a2e65cffb91665b3834b5
- SHA512 71f06cd971f6d6c783ec122bb823426be058e1107c58cbc2c6abd1e729726d676099398bf7947a50b4f9237affb073745904f5a0bf9dbfc73d25931936acb921
- TLSH
  T16D11C4115D9B1153C4088BB8B821CD9A713EBAC7549D3BD4210FE0AB39BACDB51F46DA
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral11 behavioral12
- Target
  WebOffice/tool/WebOfficeBrowser.exe
- Size 52KB
- SHA256 0325084d9a6b8158b344f206defe18cd6adfe2442116ab7290c5c2ba50fddad8
- MD5 1fd01e1b10950877342196bc200b8685
- SHA1 9c7455b881abe48cf79f3dab3a719488690654fa
- SHA512 57d1c9205709ec337d70205ca4fd9e16973c36c857b72ae43b2637b3f75cfccc50aed85da6afb4a0fab239da9aa7f5670927af4c030105c4fba642dc8732a825
- SSDEEP 768:/cUn4QN1NYU3tR7pHI+2xibkFs9ZRlzB24asxLbrCBiOg4QN1N:/ca4QN1NYwFtB24aEeXg4QN1N
- TLSH
  T1D5339326F421A12EF041C5F6395A878A60B96DB24444DD53FBC57B583AB0BE7B0F8B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  WebOffice/tool/WebView.exe
- Size 320KB
- SHA256 d5612e000d62726d211b67cf0f1c27d657789f02d6ed5ea3a741150034061ebc
- MD5 b6624b9897733601f9f8a5330e20bc7c
- SHA1 e153adce61ab60622eef05bd24970b5be38a3d08
- SHA512 04f8b521a16bb66c43aebac0994f02abf2b3d3db07b75651aaf15e72d4bb437041de03e55159099133a78e16762e599d0dfe39b0c20d322cf7d71ebc22a944b1
- SSDEEP 6144:mWidvuU81b/V7zJ1kfOq6WcFWqMRb4t4hoorat77Ckf0c0pVjsHoWZH+ANfi88+a:GjX
- TLSH
  T15A640225D70D6028F48680397A3C665B6C681E362D81EC5FFB9257693530AC3B6FCB1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  WebOffice/uninstall.bat
- Size 1KB
- SHA256 4a33986227398f64c7be1f031ca299edb97c525c950bdb0cd861278cc66b4bf2
- MD5 79ea62ed7d6fbb84f28e070c487c2fb6
- SHA1 c8f0dc098f19f8eb0d68f0bace98f49065cea68c
- SHA512 063e0780d45e86d7f0f1a0a0a404820f6fd161b2149d51947ee59d33dfa7326ad50cc69a4d4fc1d5552ae67acfc82d622934c4ad6af2a24b0ad32d0a9c8f7d33
- TLSH
  T1DC21BECF826B2003DDC1AFE1CD8D344B957E800851B9A7D47662A4B4E8A975743F7A4C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral17 behavioral18
- Target
  kingdee/aikm/aikm-menutreeedit/index.js
- Size 235KB
- SHA256 2555a6d65a5daa9162ccc786da4e6b2658720ed282a9bbff8e1904b5caaede6b
- MD5 b595eaf8af225ca7bb09e5a93d1430d0
- SHA1 b229ee0687be73890865252e317783632ecb7e3f
- SHA512 3375ef6e790fffa1f45540fe99bdc6e9179698ea0845dded12de4956a1a01eb2bfa1082fbb337ec200f107cb6e71eb545fd59a62e55cf01a7606245e53cca07a
- SSDEEP 3072:cXb2WrfhGqSDa06316CtGN4y4MnVH33DOuX3BiggF/u:cXb2SgqGa08tYTV93zXxfEG
- TLSH
  T130342AD83592F0A25BF312F6006F5807B339291B2C0D8950E661FDDA78B945EA13BF6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  kingdee/aikm/aikm-menutreeedit/js/bundle.js
- Size 77KB
- SHA256 6d864261a81cb6464e548d7891e92e3b06223fd73c676978cd0bfb46df42f97c
- MD5 2c23e268708ccd571679b35162d6f572
- SHA1 45c98bce76ab76ed3ade43cb9fd9cb1ad330d423
- SHA512 20a02b1b55a81f5abf1c898de624c94430684e7c23b657c9f7335470198342558201a2d6bec9c3629d804248004e6da9db5add194be295002d17bfd09ffe6183
- SSDEEP 1536:abFS1FTUcPh32JW7fslyIX1aJvS0NWRl2dp6CqoM0ajDu2gCMxVOTNx:abFSxmcslyIwJvS0OIpIgCWVqNx
- TLSH
  T123738E9CB7C0F079C7AB267610FF690EF57B154D949C8450D335ECA4B8B98089237EAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  kingdee/aikm/aikm-menutreeedit/js/vendors.js
- Size 1.1MB
- SHA256 5deb53f4717b17bfe73541cd1db64ac4aa8cc3dedf1851dd19d1acdc7e179645
- MD5 a3fc21e07ea9de33d0c4b1c05f6b0a12
- SHA1 40d41867e6eaab6a267466984447c1e9d5af8651
- SHA512 594ab3dc02f3cf2bef200bab8122a52e02e97cbf1d56fa0ed2acd7fc3be9cb58896a35dae999c43c5dba8f704b4bbd5f20435842823c0ca992a39e88e733a4a3
- SSDEEP 6144:CATa61dCDGnlRkDnDTDnDODeD7DeDPDnDwDnDADJDNDJDFIvSAUuGpJdzliwM:CE1d72
- TLSH
  T15C35DC512F83092C17D3EF3A6FCACB0DFA5478005850D99E7BDE742A838D695835E26B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  kingdee/bos/bigscreen/index.js
- Size 1.4MB
- SHA256 f10282f09ff3d1f5fb3746eec4e2d371bc27043c716a56d61adf80b0b24de1f7
- MD5 37bb2b8e098430d725bf1383e2220f18
- SHA1 abaa0a2235c71a3ee9b6253687f7ba03919be824
- SHA512 63b2041535f2f38a26bea11f47ad5e3f946c0857b97b70790153806b9e3fd6d6addb7a6018ea4f9f485ee5ea457139c9af8cee9ad40c263361a7d1f07bb8ec6d
- SSDEEP 12288:BDLN5GwDoq3WhENYd0HqGTP8rLj4aQj2W/84TWfz19J+/CRuLpPRQ:1LZDehYYOYHj4aHWHTyz19J4mSpQ
- TLSH
  T176650ADC7654F06143A361B5007F140FA33A290DA84E8528B656E4DABCBE49E633BF7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  kingdee/bos/bos-ai-chat-iframe/index.js
- Size 210KB
- SHA256 bdb2bdd08fc5f4ee5bce8a5dd3b3d9c1dc38fd0a6e950fb52f12c3ca354932b4
- MD5 588de9e5a465f48542b1ef35a4780946
- SHA1 b63a4ada39bbf7ed28c2888ee5931e4a321f8f87
- SHA512 a064b4c79a9b21e5ab6bdeb4bd9b218c31ab9fe7c4c9075769312606c426fcd3bc57ec06dedd1d92ed6b5686c89be50e2b71a3031fb06143d34c2341c503e941
- SSDEEP 3072:DhGq/bwC7W01ilymciPRAGdzrnGOMdg1ml7GS6x+QHxd8WOO:EqzwCK01isiPRAGdzrnGOMdoSnQwu
- TLSH
  T1E42409D83596F0A25BF312F740AF4807B379192B280D8950E751EDD9B8B841EA13BF9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  kingdee/bos/bos-ai-chat-iframe/js/bundle.js
- Size 49KB
- SHA256 01f796aac3fa0061ca6a286c6ae4b1024c0f4a0a98f033b61a0fc03f1eab3447
- MD5 0202993ba1518401a686a2dc5844595a
- SHA1 d53df42a9333b8f04044663cb6e57794406e85a9
- SHA512 65be1c1b44abf85aa43130c14f70579e3a44a58cf9259064f0616c2b67315d6da71f09ec868c86dc6db46b2aa1a3a62e30a92552cf0aa6c29f62f7e9cd85d242
- SSDEEP 1536:Wm1aJvS0NWRl2dp6CqoM0ajDu2gCMxVOTPx:WDJvS0OIpIgCWVqPx
- TLSH
  T17E33BF9877C1F07D83DA6266151F5D0AF73E294EA52C8840E729ECE1B4B844CD236F75
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  kingdee/bos/bos-ai-chat-iframe/js/vendors.js
- Size 1.2MB
- SHA256 6ef2c454f8e9c5e14e7ae26fd470db58a0d1455fc217f44094dc33b568e0ee3a
- MD5 de6dac2971ec697297a1fa6eb92d1f05
- SHA1 e0b883e2a342028aa8db791ac790c36f3db15e33
- SHA512 bfed84f9db162242532383895d2278ff8e6c282c7dcd11d270780f51e7ed94d8c1219c72d0b5ce19352847ee58e745e30c1ad6585a488c492cddd79c1cf58e47
- SSDEEP 6144:UfDvrXiI5/1NhBLlh1/HlcsDnDTDnDODeD7DeDPDnDwDnDADJDNDJDYSATc4c:zI5/JBLlh1/G75
- TLSH
  T1B65541512F82052C17D3EF3A6FDACB0DFA5478005850D8AD7BDEB42AC38D695835E26B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Manipulates Digital Signatures

Loads dropped DLL

Drops file in System32 directory

Loads dropped DLL

Drops file in System32 directory

Manipulates Digital Signatures

Checks computer location settings

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32