945fa7894f6621a93344a554cdcdab72a208e70bc7bddd166ba00fd5450cffbb

Sharing

Copy URL Twitter E-mail

General

Target
sonic4ep1 jc.rar
Size 165.8MB
Sample260824-bvx3hsxtft
SHA256 945fa7894f6621a93344a554cdcdab72a208e70bc7bddd166ba00fd5450cffbb
MD5 b198c0b189144592bacce5216704043b
SHA1 ca9e722eef6acc2d6ae63bf8d2d135af52be1db6
SHA512 35e8ee5bbcdf5d0b2b414f131c96b85ddd96ad1847df494a437c9a50fb8489adffe9649a6a384ec177a96950ce0db32e9475965d2a13cea7d4ded40253931fcf
SSDEEP 3145728:ARgTUkqSVVLIHz0K4o2zWp2NausZ3XATzC3b4QOo7DXy05DIixMAOvBXyIsEK872:A2Ukq+VGzX4U2gRZg4bso20uiGAQXyH5
TLSH
T11388333C2BE58DDAFCEE667604A677352D10E06189FE6D6B50394BC3B8064D8C87B643
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Sonic the Hedgehog 4 - Episode I/D3DX9.dll
- Size 1.9MB
- SHA256 17cb112704b3f7cf70cc386e50a41304ad6508e95265c00e4ccc42aadc5454b1
- MD5 b17fa8b31d403faff9143c5bd2f4646e
- SHA1 b29a8088af11bae0048da6df0369cff72f8e302d
- SHA512 f664cbf2916192e64521b4885e3d09f609af5742ded50adbfd58aa1d80b1fb2c3001c0f5e20b4609d74ad56ca2a23b9014a0260bd5b759c095c0f4de88333b5f
- SSDEEP 49152:zrlaTZoJu1wfuhM2dhYmnU1dE1KCdQiCPnLLc2//Viij3YVLiiZBhs9LCrMgl5:zrlaNoJu1wfuhM2dhYmnU1dE1PQiCPnw
- TLSH
  T1BA95AE41FADBA1B5D8670138111E33F162B90F311560EBCFE6507E496FB16A2CBB8267
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1
- Target
  Sonic the Hedgehog 4 - Episode I/D3DX9_41.dll
- Size 4.0MB
- SHA256 6ac4df203af419d3f3b7d9a99e14a3490ea3ad307c474bfe36baea642b1421f6
- MD5 3fa06cf5079b84155d18b05c08f7131b
- SHA1 fafe52876151a08f39dbb6b4aa137dd85558ba5f
- SHA512 24d29c3ffb6532da860fef4dd93e61f7532cea3af94928495a3af0231e7dff6db5cad25713451a2e722c076462b94818cd6969a1c7d8905585b0f64e12174d1e
- SSDEEP 98304:DdpF8pg4HYUQpisB7+86QJxpj+p9jdIcFXZvkyIOPsmQJAax0z:ppF8pVAisL6QJxpj+p9jdIcFXZMyILAf
- TLSH
  T19416BF60D60A8039CCDA51B5664E33B5356C8F71432057CF62683FEAAE747E29F3825B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  Sonic the Hedgehog 4 - Episode I/SonicLauncher.exe
- Size 1.3MB
- SHA256 4983db08aa64463f3a89ff209c42fa023e0e2233ebc6b8d5765e3376a46b149b
- MD5 0c69516b2a9185602fe84c5ad089ba3e
- SHA1 2c9d9709ce8156bbea3f6142e1bcc6ab8c0fc042
- SHA512 c15eaeade76087631c85fe3d9636b363154d235b7d608243bb14309c998e8cd4fd3f6290de42f5f139610fd87469a51b8878332fda4f947cd15926609ca0f2e7
- SSDEEP 24576:rwdU8TS++13SPDijExI/fNKInrxCXPd+Eb7lt5aIuB6LsMTjMh:rb8TX+3SPWjOIHBC0Q7lt5Bfw
- TLSH
  T1E65523E2BCF965A1CE2B02304684453332713248ABCA7B31BF0B6F73BD5254A655F967
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3
- Target
  Sonic the Hedgehog 4 - Episode I/TDU1k.exe
- Size 44KB
- SHA256 c339f14d7980375e12b92e501e612e0102d2d0ba34e0d21200130d335e703602
- MD5 94ac52bdc0d9192914e5a60cbde751aa
- SHA1 7d71cbc1a0bc7864f826020cb042ad611f7b23c3
- SHA512 7fee57fcc7b6927f034da82dccf044b029816b9175ee704961e8567ba5b2b329671abf2aa18cb001bc5af18678d467ab70449a56947817b48ee42d61a7198f31
- SSDEEP 768:swbYnNcMTmil8e/IyvWnekbCKQ1v/Gr4mTYGUahXhrWP8NlQiUPOsTi+:sw8n1cAIyvWLOK2v/deZRa8NlQ/OsH
- TLSH
  T1C613F10E7B262B1DC56910321AABE3742A9D7F1AB9784E0F43FBBE4F7CB2641015414C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
behavioral4
- Target
  Sonic the Hedgehog 4 - Episode I/msvcp100.dll
- Size 411KB
- SHA256 a3ba6421991241bea9c8334b62c3088f8f131ab906c3cc52113945d05016a35f
- MD5 03e9314004f504a14a61c3d364b62f66
- SHA1 0aa3caac24fdf9d9d4c618e2bbf0a063036cd55d
- SHA512 2fcff4439d2759d93c57d49b24f28ae89b7698e284e76ac65fe2b50bdefc23a8cc3c83891d671de4e4c0f036cef810856de79ac2b028aa89a895bf35abff8c8d
- SSDEEP 12288:iHEqYsrMWIqz473PTiPoH/aGhUgiW6QR7t5qv3Ooc8UHkC2eKq87:iH9YsIWIW4rPTiPofaDv3Ooc8UHkC2e8
- TLSH
  T1319427237A4649F5E1D223F46289932143F9FCA40721B3C3E2EFE1A99F583D16A73951
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  Sonic the Hedgehog 4 - Episode I/msvcr100.dll
- Size 755KB
- SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
- MD5 0e37fbfa79d349d672456923ec5fbbe3
- SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
- SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
- SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
- TLSH
  T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral6
- Target
  Sonic the Hedgehog 4 - Episode I/sonic.exe
- Size 1.9MB
- SHA256 0fe56d2a5a44b52554268ed24083128ca180057a37fbfb37ea3df97abeb0e826
- MD5 6b69968e21ec53f751c418a55f1e56e2
- SHA1 f6d51248ef50bfef031f259fde1c7ab889a33c39
- SHA512 2630e1823779975f6dd81ddcf2e0bf89bc64b6dbde77b60deda055061a258b7b0aa13bef1fc0f31a969a1f087b6c06225cc315b370a670c658dc76683aea8468
- SSDEEP 24576:ijtHIuFHtokqyJtgKvRMyoV7luUQWfLilI1k15gIM/M5yRIEdU8TSN40:m7Dt/tNeZuUQWziIk7MM5w88TQ4
- TLSH
  T19B957D10B5408576E88D9179CAEDDFBD483D9E119B2D60C37BF83B9A6F30AE29435603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
behavioral7
- Target
  Sonic the Hedgehog 4 - Episode I/storm_api.dll
- Size 23KB
- SHA256 1d86804b02e3eeaa20e9b8376daed76fd58c13966c111e5ce433e8b7c7be58b2
- MD5 5df087ade0cfdd79d5b5d7d9087a27de
- SHA1 718426f1f1449a29250100b5132869bae78d854c
- SHA512 2a56be642299f7b200c0395f5d6846d2b78da11492f3270cc8ed5beaf34910f490ed25d1c2c5c619449752582caa266c82d05187890168db14516c85140cee96
- SSDEEP 384:ouSdPQXJ5LaLdUd+Ra/bDYq3mTd7FlC8LxARIifCxrZIaNJawcudoD7UnxK:vJ5LUoS2cLThffifkVhnbcuyD7UxK
- TLSH
  T134B2CF97E07503A3C87DE17B5DEA780F327892175FE4CF75EE989137A8C0A063922549
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral8
- Target
  Sonic the Hedgehog 4 - Episode I/xinput1_3.dll
- Size 79KB
- SHA256 8d540d484ea41e374fd0107d55d253f87ded4ce780d515d8fd59bbe8c98970a7
- MD5 77f595dee5ffacea72b135b1fce1312e
- SHA1 d2a710b332de3ef7a576e0aed27b0ae66892b7e9
- SHA512 a8683050d7758c248052c11ac6a46c9a0b3b3773902cca478c1961b6d9d2d57c75a8c925ba5af4499989c0f44b34eaf57abafafa26506c31e5e4769fb3439746
- SSDEEP 1536:TVeqvNS6T6jxeEsU6b0xZtDDVb9X8u9JA7zitdrz/R8cy/FaeBD:TVeqvNOeFgxZ9DVVtRBy/EeD
- TLSH
  T199835B107480D236D8E361F806FDB714763CD66513A559C32BC4BBEE9EA63C26E3069B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Drops desktop.ini file(s)

Enumerates connected drives

Executes dropped EXE

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Drops desktop.ini file(s)

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9