5644e5e88865e3a58b60a7722d611c59d3ce8ba6e43ad710fccdd4f42aba5a5a

Sharing

Copy URL Twitter E-mail

General

Target
YourHappyPlace.zip
Size 747.4MB
Sample260825-c2wnpsej2s
SHA256 5644e5e88865e3a58b60a7722d611c59d3ce8ba6e43ad710fccdd4f42aba5a5a
MD5 a49ba0fb79e0db540e9f90b5241becb9
SHA1 e1d85a14bf6caba5d83f6baf3d44dd82bb6384ed
SHA512 5117a0051e3baea5d7e5cc553d1aa57f039f1f3eb22df7e792bcf96d6afd0a475d4c8214b63fce2e392390530e933635073953c711de7b98244da18e74242eb0
SSDEEP 12582912:+qff7I/YANBzkLd9Sy3t5FKiBGpiOgyBs0LA7wJP849gjekbJk7RhUaJGIXZ+hJM:+qff0/YANB+rKiBGpit0E7GP8m4HFSRX
TLSH
T1148933637FC9CF3FE022A83742869A46A1257E7220041DD1E531B758AD775CE827F78A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  YourHappyPlace/Windows/Engine/Binaries/ThirdParty/DbgHelp/dbghelp.dll
- Size 1.8MB
- SHA256 2156fe68b020ad95ab88b06497b19340f3b284c212419946c0b17f47b28438f0
- MD5 a66b36d62438960484663f9b65d38aa7
- SHA1 ffc3a7ae79518269189be5bce7ac2f22b6bebee1
- SHA512 6ef0db18fedbd735a5f3d8087b5622fac81ad31e6fe5b91a833f37f34d9ac0c5c61994fcb228f9393a7d1df711a3af81a69b18a3066b5a54a9bf836ba75ca10c
- SSDEEP 24576:D2I0ZwKNsVquEs4na7aDb4FzoRlUFs/9w7l38jxb9X7IqLC4Xe:D2Itw/s4na75c6Fa9IlE5Eqs
- TLSH
  T146957B5A52EC01BCEDBEE13C8656821BD7F27825172197CF16A0876E6F27EE2163D310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  YourHappyPlace/Windows/Engine/Binaries/ThirdParty/NVIDIA/NVaftermath/Win64/GFSDK_Aftermath_Lib.x64.dll
- Size 1.4MB
- SHA256 ab7eb6fd41800b80500198adadf7d3429614e20b4f5b4e32ffcb4d420b3a724c
- MD5 11b4837d2b180fc67cbf695cc396106b
- SHA1 58282280eadd75641927913913e94627a3a1c337
- SHA512 1f837c0a67d75e74b26883489d83e32ed0262134a45a3157732b15c8a634f57f528d18c66b3a3bbb1672d07225688b83d508aff97a87a422501627f091fd9358
- SSDEEP 24576:f/KlxXRBfAGKt1tEoG8wkxdShweSbSr2I6dM4:nK/RB4Gg1tEoG8wkxdShw5S6In4
- TLSH
  T1B2656C067705C2E9C02BE478CA934E8BD371BC919B2067DF72D15A281E73BE55E7B290
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2 behavioral3
- Target
  YourHappyPlace/Windows/Engine/Binaries/ThirdParty/Ogg/Win64/VS2015/libogg_64.dll
- Size 63KB
- SHA256 29817c5c383c1ce43ab796c393e971066b84cdc80138dc80c1d246c250e87dc2
- MD5 8ad8a72c6ff00663ecd60ae9909128bb
- SHA1 ecdf48187e66d37a3e26f9e5ce140626c0f997ca
- SHA512 3a7185aa75fff92d52a450b4ac439dad905be1a1830ab47c9198ba1f112c1c4d533e89d9606708c6544469e9781b51794a4e6c1199f65962e94bba5800ef07c7
- SSDEEP 768:CkSQyQUuFq19HAhjXuhDGd9PxWE9dgDGHQ3hLq:CXHAhjXuU9Pxp7Q3hLq
- TLSH
  T199537C4B4724686BE97B897E70E8D326E9317640936147EB436CC3850F43BCA3A7926D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4 behavioral5
- Target
  YourHappyPlace/Windows/Engine/Binaries/ThirdParty/Vorbis/Win64/VS2015/libvorbis_64.dll
- Size 1.7MB
- SHA256 eeb518804247bf40c7b94ff15d337578a57af371a3e7078feb2357569c972309
- MD5 32cd20fb089ee904af385c6e4aa42b17
- SHA1 fc2b33f82b9a944ab283d4818a8cb34a2eb1b120
- SHA512 df91c645540997234810da1d660c852d914256e4918ed22c6460443ac388aaa401e60f3b5985a210bdc7cd6001bd3ee5c4a9a9e5d737ed5c3da03d6eb93c4a8a
- SSDEEP 6144:JbbUbUwlPxtVNA0ueMSMMYGUXoz0A1VoqxRCvrsQ:lulPcDe2XNS2rH
- TLSH
  T148851F0759928B34C1BC50B588DB557853322C4DAE800F9E7BDCE67434D3678BEA2BAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  YourHappyPlace/Windows/Engine/Binaries/ThirdParty/Vorbis/Win64/VS2015/libvorbisfile_64.dll
- Size 52KB
- SHA256 4e6d8c053d49166f1d8598b275069ecfb853e14c09d456528ab92e1d3f670bbd
- MD5 720b4c168e4d46c8a1d44c04672debf9
- SHA1 f4e8aeac174b94d57b6cbd05ce691d882a765ae9
- SHA512 6204bc803ff913fe90a72a4422a110f9559f3943a6a5cbf7f56f6cdc5e2c03f1e665489bf9bfa5f0b8ff66d94abaddcd8a3b0f97af319b0bb31b449ea242f028
- SSDEEP 768:4Dnv89iBswdSAQS7kWW/BerDGrPxWExsDGz3hVA:68ks7SDWo+Pxf3hVA
- TLSH
  T13D338D9697B138DBDCA7CD39B1DA5A2BFE707242532055EF4368C0615F52BC2333A229
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8 behavioral9
- Target
  YourHappyPlace/Windows/Engine/Binaries/ThirdParty/Windows/WinPixEventRuntime/x64/WinPixEventRuntime.dll
- Size 69KB
- SHA256 23e775168d2a082839bb3ddb44c45adcbb9c4863b6127edaced5ba95ce0b09d2
- MD5 cf480be7eda4d34a3fa78b6823198b26
- SHA1 7dfe5922a17dbd310de31ea2ac5e4341e0797622
- SHA512 50236508d927a0c307a3999416c8152a1978001f9d7147851ff10ed0383978e30181375836789fea54e179379c0e09d27c25092f6fd6646eaf0c19b7f54c8fcb
- SSDEEP 1536:Lw+YjY5lOHxrrt4vuVz1e3h+GPx95sP26Qyvzn:6qlKxrre89yxnsRQyvr
- TLSH
  T12A638D96C7681482E9A7D970A1E6F917FD75B3C31B20C2DF4225D2490F93BC1AB3922D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  YourHappyPlace/Windows/Engine/Binaries/ThirdParty/Windows/XAudio2_9/x64/xaudio2_9redist.dll
- Size 843KB
- SHA256 ee1db1affd936dc59540199b6b692a467cb4f9d050041b572acc1f5302e012bc
- MD5 de613f015be1265e159aed1eb3fbb34c
- SHA1 376511f7d0e7f314e13b0c703266668524a034d6
- SHA512 4cce588735d620bf99ebb6d0099f3b222a081565ada090fcb20093d963ec30dc82bc4a720d72f0d17b09e5c7468b04f2f3d3f323bd82a8cb128b35bc5e3cadfa
- SSDEEP 24576:S+6PHmQBNmTqtEcl+4n0wcktNvSRbESezx:ShBI9InQMNvMY
- TLSH
  T181058C53F6E549F5D16B51359167BB1BF672B40027254EFB02A086283FF3BC01ABA3A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  YourHappyPlace/Windows/Engine/Extras/Redist/en-us/UEPrereqSetup_x64.exe
- Size 48.0MB
- SHA256 1a74ec10fb15d36472ad2267e297c84431ab376bda01b8326df77ba540b9cabc
- MD5 9a9c467ef1912bd48db78961c6c7d870
- SHA1 5a37b48f8639ef246ea3d81188935ecf253bfb91
- SHA512 d1cf31d35c3fbb5dc0a15938026cec459c44bfed192ab66dbfc4c45c9d8bd16f26c2a835aea70b030e2a5ea80b5c11b40dd5c35de71a7c49c740b0d8f0595641
- SSDEEP 786432:k/bdC1Q6cdW2xTDUANjtdoTtwe/UUjwirV6po5O5wnbKJO56XN4yfQSyABGOw:I5xTLNjtdoTtd/djwiB6po5UwnbSOMeh
- TLSH
  T152B73373B88CC62ECF931837E546B9081E2E3525625094B7E25CCDEB2E3716322F6756
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  YourHappyPlace/Windows/VHSLiminal/Binaries/Win64/D3D12/D3D12Core.dll
- Size 5.0MB
- SHA256 771e59c40dd706e4cb5b5374ef8d5ed9f4f603acf51fe29d2e42ac0c0cbc4234
- MD5 416667c38890f36c7bdd9ad1427f0d79
- SHA1 2e68d82edc8ea4e9832934c96118e29c111c48da
- SHA512 8b8cfd039de881127a3750eca8420d5501af467b30769cb007984de07a700e2672ed7f5119d9e6841b58abb7de844e05dd1b1f4ccb1a0f7c9be27e1c1511fd26
- SSDEEP 49152:usQFTCsFJsv+3Wn5J6Uu1Pvpb0TNQTp7BJehNu+Egeq0SpVSQNcJ057UUGjWX:wT9sv+GWtTxTqAzd8
- TLSH
  T1DC366C47B6E801A8E4B7D07CCEF7461AFAB2742153715BDB11514BE92E03BE04A7B3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  YourHappyPlace/Windows/VHSLiminal/Binaries/Win64/D3D12/d3d12SDKLayers.dll
- Size 8.8MB
- SHA256 81d0af5bf512ed3e012ec44bf5d7ef571f1f8bac7eb327852f27a3267a39496c
- MD5 af685db8c05318a57f6f7013ddcb5e72
- SHA1 cce1863b005c82fddaaedfbfd4f64e5a0f64947e
- SHA512 378843ea363ab5f649b59fb1e56d8a5f0652b3fbb9cefd04aae6d9c3981c9f15cb62ce465fc9dcbf568bbea380af0eee639bf406784726a82e1f6bfb28f1af37
- SSDEEP 98304:PSerC5BplBthOkGNM9MKcYoH16+SYj275T/rOQDYlYPFii71:PSJthOkGewfHNSU2dT/rHJV71
- TLSH
  T1C4966B5763A901A8D57BD17CCA879A07E6B274150361ABCF06A0879A2F33FF51E3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  YourHappyPlace/Windows/VHSLiminal/Binaries/Win64/OpenImageDenoise.dll
- Size 47.5MB
- SHA256 b1cad77567f7b26d051c704610b8e80435dc01208cb2b87cda36199b84019642
- MD5 374807f115c9c7533916a895a0d80a23
- SHA1 4ede8821b5f96eb4d7e4790dd7014936bf5a5313
- SHA512 3f05dc79f05f45c9297147a93a720492365c43f92afd7752c90ae2002fe622608aa18b90c76a96614a8fcd35c6158e355db2f22a0fa7c5973c5f03467b89a098
- SSDEEP 786432:nnytAKo2dZOplxaeiF9Oz6CJk9w5ksfQYOSCIAnrxeMMNKo6LnZyj4fm2YkLuypT:2W3pqPFUzJgw5hfXOXHnrbMZOnC4fmtS
- TLSH
  T1D9B723A3B1B6D4D5C17AC07E820F5363AB7278E9023766B7A2D1E6753CB1E502938770
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  YourHappyPlace/Windows/VHSLiminal/Binaries/Win64/VHSLiminal.exe
- Size 230.7MB
- SHA256 e73faa6f21014cc7171543f8225e9d9f5eb4fc53898e19e111d09875c9dc3902
- MD5 078fb3a95698a6769586f051bd0846b7
- SHA1 01fffa77217ef06a1cb0150e7145cd7565a6224f
- SHA512 c7d392168941bf3c481f0b25cf9daa5b084f0401e434e4a0d6738d81985ace72ba5bd2fdb6164e394c14c412248a4d31b8f90df983a61f0345d5f7b96f3d7a50
- SSDEEP 1572864:nMF0Xc9NOptci9fi8rkkdv2kXvb081XH:7HZ3rfbX
- TLSH
  T150B87D4773E421C8D07BC17EDA6A6715EAB138A9432197DF099085CD2F33FE9587AB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
behavioral21 behavioral22
- Target
  YourHappyPlace/Windows/VHSLiminal/Binaries/Win64/boost_atomic-vc142-mt-x64-1_70.dll
- Size 25KB
- SHA256 7e7c15f0751002d38a6c829a759c5d88d7050d5b14ffb22ddb463cc74b211839
- MD5 729d0ba5f6793359cf5ea1201a5b61ea
- SHA1 e307e75a2b0d2a22b5c1149c4b17ceba35cad418
- SHA512 ab9d3715b291748fcc8aa902e03ea611815870940508cb2d13f74fac1c5f2584554d0d17154ecb574cb18c0de0ce845288110e59c672fc3be5e31dc374d17bac
- SSDEEP 384:ZHaQkR5i8GP++Y3DGUrPxh8E9VF0NyCwFVT+Y3DGE1R8JN77hh7cmjp2:ZH2iSDGmPxWEccVZDGe+3htvk
- TLSH
  T1E8C25B4B8B161C82EE178E71B0D4DA2BAE30B7816B9181E7537CC1915FC2B8636BD19D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  YourHappyPlace/Windows/VHSLiminal/Binaries/Win64/boost_chrono-vc142-mt-x64-1_70.dll
- Size 50KB
- SHA256 1b52c13444ed4842d2f4d9f6b3f89e2983273088e7f8dcc2affb2a708a2b1922
- MD5 f9e8efbb0a8554055c6e3784c70d9b1c
- SHA1 da62a3fc1c31323bee138152b0d557c516198456
- SHA512 996f73359226e90abffeaa5d97ea5603b60f7036f8ba259ca51825cf5fa58feddffd0f24c3cfc9b1abb856ca29430cf92c7f48750deb7f64793c86fbebf1ba75
- SSDEEP 768:jda7ZyL2JXmc45vsYEyULWL3IDGTPxWEcFnxDGEiU3hHU:jKZReEWLvPx6r3hHU
- TLSH
  T14D336C8587284899E15AC87DF193853EDA327D81874382DF5368C24CCFA7BC4BBBE512
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  YourHappyPlace/Windows/VHSLiminal/Binaries/Win64/boost_iostreams-vc142-mt-x64-1_70.dll
- Size 65KB
- SHA256 a557988059f2a485ee1c86c0fc8c0cb27a997521e9e20ee969cc834ff8d8e2e1
- MD5 e2aa764cf16d2bbe79b7b59539e40547
- SHA1 eaeeee33a748651c65e6c5fd561bf71a0fe20ca2
- SHA512 2f22c4449ba16fd16cb1867187e25ccb9b4a60501b962dffc756c8dad41cfd2845f171e6dde27e44f64db76cf518d2dd92498c234cd2d49efcd3aa1a3a66a846
- SSDEEP 1536:MMCMMAf1tUZR8dsiVDLK/aWdR/9zTPxq3h2N:MGhLKyMRpxnN
- TLSH
  T17163294BEE1444A1C496C23CD59A8E17D6B17985C702D3DF83E8C22D1FA33C66EBE691
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  YourHappyPlace/Windows/VHSLiminal/Binaries/Win64/boost_program_options-vc142-mt-x64-1_70.dll
- Size 402KB
- SHA256 fbc1dad22b290113720f803e66f810c2fc6eab6d68b5648c2f0631dade3a6ab6
- MD5 77de1ef9db6c8da34744c1424b8abbd3
- SHA1 5041d7783c489a8e16c5ca6b6c011708f384ab5b
- SHA512 0aefd5d24a16b89fec4e70ddde8e426eb4fcc87f91be9e6a74aba5b492c0f69af046e2686a8e30a085c30acd9fd8dd3fca2c90ef2f09882c2414bd128289b893
- SSDEEP 6144:Ipnh0TjTjrMSDRDAfTyWuvYfC6MxVmqSLyOqzEoXN:IpnhojrMSDRDQTyW6Y6QIoo9
- TLSH
  T146940907B21C49D7E4E7A2F8E6868905E371BC41D709E7DB06E5836B4F93BC8857B620
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  YourHappyPlace/Windows/VHSLiminal/Binaries/Win64/boost_python39-vc142-mt-x64-1_70.dll
- Size 206KB
- SHA256 f041dde4fee1d378e047f1eeba205bc2d0400da59e8473273eeddeb3ef91ad41
- MD5 ca3d48e0f73e615a9f016dddb49fabd3
- SHA1 d0ea9cc9cf9f9d12dd189dea7bd4ca4edad0e088
- SHA512 cd55822b9771f5f3c98607e01fd86436a50e31866000681d76df9a9ccf21f97b9dea532e41709fddcddb52fec9b5c207804c3069b7ca6a5a9212a2ff5b192b30
- SSDEEP 6144:5EbNAlEe1SEUVtAfzLJBIYCLyxKDueKjpIm/s3SxG:52EstUQ
- TLSH
  T19F24181A721880C5D663C13DC9538A45E673B8828B5117CF227AC3AA7F8FAD67D3D391
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Loads dropped DLL

Checks installed software on the system

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32