Extracted

Extracted

• • Target
    ​tnngggg/1047579563330228919.mp4.lnk
  • Size 687B
  • SHA256 e5202c70b8015c5b2048878e45330696aee5d16e2bc05e51c485e3e62a38d651
  • MD5 6bc7408c6fe3da2740aa4a5289167246
  • SHA1 8b77b2fae74d1785acc9f9fd835f06e0fd2448d9
  • SHA512 ade7367ab498f6c1866f5aab1282038c49a2f8f48113043e526d4dfc47def8b7366f993e151595aac688ce8fffe1192dbdc2af5628629a2b3e29c592e39762c6
  • TLSH
    T19201420025585B28C3735D3788A6570156227E4EDE35DF6C019495CC9858284AE2AF6D
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  executiondiscovery

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2
• • Target
    ​tnngggg/20260701_063149.mp4.lnk
  • Size 683B
  • SHA256 2423b6a598db7678752813de3261a2611df23ca94172929b03b41b29a6413fe6
  • MD5 a19b58e5f3c4abb9e84875cdebc3f953
  • SHA1 f046bf39a3c51b6e45f438b3d77c0067489dd0cc
  • SHA512 375347b6cb1fd7a9f87e9b554f3b519e7dd28051cb4ef8ccc88e172c3dfd7db4c077d635b2bf2dfcb319a6a7aaedf5f1e7676e45abc3168c53e2931978708a1f
  • TLSH
    T1C8014C1421AC5719C3734E7748AA53029A317E4DEA31CB6C01A496CDA858684EE2AF6A
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  executionadwarediscoverypersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4
• • Target
    ​tnngggg/20260708_074630.mp4.lnk
  • Size 683B
  • SHA256 b6313f3f257c5da7fe4270f91cf5cb968753880dce025caaae53ac08f793d1f2
  • MD5 e79f3f4cd67c6611e08bed12963c292c
  • SHA1 d88d898cbdcbfee93517fc45e7a1d95b636fa7cb
  • SHA512 d6c4705b4cfa13ebcbb5695955471cc5812e6fdc840d51f691b18211102098131cf257cd3889658ba70e7bcccef818b24bc522f47d410e64e30ba8509e685e4b
  • TLSH
    T178014C1021985B28C3B24D7749BA530256257E4AEB31CB6C0594A68C9C18284EE3AF6A
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionadwareexploitpersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Possible privilege escalation attempt

    exploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  behavioral5behavioral6
• • Target
    ​tnngggg/20260802_031236.mp4.lnk
  • Size 679B
  • SHA256 306d91872726367c6bbb73651011518f4da8f1de7f44d0415add32085ea6b89b
  • MD5 f9b126fa15db1ece6872d98c92d24553
  • SHA1 6ee96a4193d6b9672bdd723d5d8f5937b79b3c2f
  • SHA512 8487350beb33da520fb0200f8e9e5b60e6b4fb5939172902e912e8496247152892d163a0409f150e8cfaba6da5e755d2f20b1833250cd5b62bff71abc6b2190d
  • TLSH
    T193014C0421985B18C3725D7798A69B0256227E8AEA31DB6C0194A6CC9818284FD2AF6E
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiondonutloaderloaderadwareexploitpersistenceransomwarespyware

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Possible privilege escalation attempt

    exploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  behavioral7behavioral8
• • Target
    ​tnngggg/20260821_064654.mp4.lnk
  • Size 683B
  • SHA256 a4d3dea8688254e6f5608ee00a91100fb0d0f9d4ca232395f8fe64dd81ace29c
  • MD5 ba2cf1aa4c41d7d65664f68278fa3a6d
  • SHA1 7eadf4ea3937ea858e31d1337dab9e78371ede44
  • SHA512 3b37444a539519350217838bd59778aacdf7c76cc4be2f298ae232f084b6ad2c7a8c6e8b3869727f3776320cac87ef6e1b6658fccb75f58990541a0c1eaa3ccb
  • TLSH
    T1F5014C04219C571AC3724E77487A53019A317A49FA31DB6C01A4A58D9858584EE2AF6A
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  discoveryexecutiondefense_evasiondonutloaderloader

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral10behavioral9
• • Target
    ​tnngggg/20260821_153531.mp4.lnk
  • Size 683B
  • SHA256 fd83c0481d6a856c3ed8a00d74e2554241ef4629da56a95042ed1282572517b4
  • MD5 7bbc1669ebc563a8cb3a6d982266e5c1
  • SHA1 ee9d82aeda5f33045572087f13bd4345aed2b849
  • SHA512 f9d1e0ae97e8b9040739829fbb8e95f8c1b1f146eee70bca71154b25521f31d5cf0b7ad1bb3440897cbb122db4290ff3416e4e1b2d0dc6e1012585dafb5599ae
  • TLSH
    T101014C0021985728C3B24D77897A570196257A4AEE31DF6C0194A5CC9818284EE3AF6F
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  executiondefense_evasiondiscovery

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Modifies file permissions

    discovery

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral11behavioral12