15481d4c28e3549a347b08dc68662a4ab866dcd1c8efb51d4ed4ad320a8bf5c3

Sharing

Copy URL Twitter E-mail

General

Target
csp 4.0 installer.zip
Size 608.4MB
Sample260822-pegmgsyvay
SHA256 15481d4c28e3549a347b08dc68662a4ab866dcd1c8efb51d4ed4ad320a8bf5c3
MD5 6eddb2aa0bba48af926080ccf25d2ca8
SHA1 1eaf028ae9c8b60e74b86a583440c524ac0eb80c
SHA512 d9599c2ce248aa054ef2fe0a72deef8667ac6ac0db3f8f29247a3899d1a5fd838550e45ecd932880d477245a56c5a827f65d689d1ce0167fd8a816e2bd2359a5
SSDEEP 12582912:37bZMaJYfgK43DfXKt/1CGnr4Yx5mCmveeO3EoFedrCPPE3B0:37bGaeYKyjKt9CGnsYx5mCdT42P8R0
TLSH
T1616933CC34FB5F41940EF51778484A89B519919AA526C17A72D2FB88E8BD3D33ECEC42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Clip Studio Paint EX v4.0.0/CSP_400w_setup.exe
- Size 442.4MB
- SHA256 5f0da6c57f6428f5b2c3f456e96484d05565c2ce0603c7b96654fccdd5c1a97e
- MD5 f1f603ee8acb71dfad5ef5565e9bfeb8
- SHA1 11bc465a895e23ecd0f420471ff72a98750b6f57
- SHA512 7b96a2baf0c56373370f72edb78a9b3425b3f1a16235038f62f69dfe41b2af749f1150dd9dbdf084a230d2e89ec0e0be7267207e76265163a0b43c8fc6254ae3
- SSDEEP 12582912:fTRDAOfymc2yapUk10I8M9Y3wRF/tkP2K3h2Uc8xJ:fTRUOKP2TF10I8RgRF/qPpcI
- TLSH
  T17B293317A484892EE4BF4631ADAF0D51BA647C336B31848B72D0FB685CF17C1BA73616
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  Clip Studio Paint EX v4.0.0/Patch/Multilanguage/CLIPStudioPaint.exe
- Size 38.4MB
- SHA256 e952dd4af41b94e0ee5129da8893f1b36d45a92553d91ca5c1e52237c71b981c
- MD5 3d0f75e70746ba4e60c6c761ef6163e4
- SHA1 767e8af46dd6fd21e64b1eb9bbb0922825434bc2
- SHA512 480fbbd15e7b650a883a166372276689724b3a7e378fca9691ea1e79366fb4304f5681bf1cfcc26959a4341e2c3bdc94da846624e766a170356867e4159f833d
- SSDEEP 786432:GetrNsm/7bl5+cgiWFCPGZo9Ke1a7IuODkb+m2plijhWqBwl5:bFc5Wuo9Ke1aRbtVWqO5
- TLSH
  T16F970116778CE0C0DA3E55F0D955EAF719D99D2FCAA4A00F92493E7C3DB238A10669C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Clip Studio Paint EX v4.0.0/Patch/Simplified Chinese/启动画面01-CSP娘/CLIPStudioPaint.exe
- Size 37.1MB
- SHA256 06c369da86d9998ccbbdc097041bbf68b0538ed5e06e4eecbc29566406bb035d
- MD5 471489f132dd052bc4d1449daa5b928a
- SHA1 d94e573593d142983fbbc1e9a66b3c40d023db26
- SHA512 a5f30e06ffb9bc37e5840ccb3492261327d702bff62c6f70e08685a57efa81d6c9eba2aebedf465ea11c488a5088f9beb94babee2e3cbc644c9c15de994ea82f
- SSDEEP 786432:j8NCJtdUR0z01b9I97LA/v17KWGqR1XZ/275bAc+HCwHTjPz:jTjd/01baJLA/v17KY8750c+HdTjPz
- TLSH
  T1D787F112B78CE0C0DA3E55F0D9599AF719DD9D2FDAA4A00F91087E7D3D7238A10A68C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Clip Studio Paint EX v4.0.0/Patch/Simplified Chinese/启动画面02-白毛兽耳萝莉女仆/CLIPStudioPaint.exe
- Size 35.7MB
- SHA256 d73ef117a48ffeb088c29e296171b156b96407699b151efb7eb0f7379561c1be
- MD5 95ce72005ecda6c9f43d9cf5284cee3d
- SHA1 24e2148c71f569711d3a65721e2e4f27e9531ed1
- SHA512 f335c677db2564d2f5ca53c0d4add46acfe5a6d24857d7c5f3580ca86aa2e30af622d24f49a21a55f31b648ae924725ff5894a73ad09673eded5cd4d90033a48
- SSDEEP 786432:Am/9KEfkVjMKgG1QaYcDoydiIV4YjbsGHc5leSwq9G:rpsFn//V4wbsG85kQ9G
- TLSH
  T1B287F116778CE0C0DA3E55F0D9599AF719DD9D2FCAA4A00F92093E7C3C7238A10A69C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Clip Studio Paint EX v4.0.0/Patch/Traditional Chinese/啓動畫面01-CSP娘/CLIPStudioPaint.exe
- Size 36.1MB
- SHA256 a63bbe02639cd78ec8c31921f6e32010d1f836a8a2f9c455bea095ee474d3455
- MD5 ebd22e17a13980930319545deb3f772f
- SHA1 e10e97a56622ebf74e7a098e2addbc0cedf9d36c
- SHA512 8947db3e6a049e4d06e7fbac164182b053f9fd817687119645e726c81eef43139236b7652ac0013d2dc402a324a7f7bc5654047a9d5708c711b625aa261e07d1
- SSDEEP 786432:gunmfhuw/LoOPpiv70obp/e0GjsLpV5K2SqD1kcTO5TAJw6Ycz:gunahNHPMTBbp/2sD5K2vTO52/
- TLSH
  T12887F116778CE0C0DA3E55F0D9599AF719DD9D2FCAA4A00F92087E7D3D7238A10A68C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Clip Studio Paint EX v4.0.0/Patch/Traditional Chinese/啓動畫面02-白毛獸耳蘿莉女僕/CLIPStudioPaint.exe
- Size 34.8MB
- SHA256 8a2c36c7dfcb93bfa1727937f11038b3a4ad6f47e4ce10380f07b5a8ae7a5e4b
- MD5 48e2f8e0ca22f2260fc82adc0004ba43
- SHA1 34e6a8b4dd536f72900a7d7c5f899d3c9ac54bba
- SHA512 45740ea007f63658a806bcc446e76967f640a4d7191fc94840bb8fb65a50b11bfe86e448bcfb3a706bb00ca968f3965eae8f88c650a2bdd9e9298d3f156573ce
- SSDEEP 786432:595iwqdi09C2cQLs1r+Bh9b1UAi1WRW5tRfeEu5eBw1XZ:B2di0/cQwMBn1diMRmTf+55p
- TLSH
  T1AA87F116778CE0C0DA3E55F0D9599AF719DD9D2FCAA4A00F92087E7C3D7238A10A69C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12