Extracted

• • Target
    Natro_Macro_v1.0.0.2.zip
  • Size 6.9MB
  • SHA256 4adfeb9a9f584c7039a6aa3b0121f7ed6c17b5ff85479b6a7246a28d619a669a
  • MD5 eb7d5b3606956d9e009fdbc384f6b843
  • SHA1 a5653151bd36a11afc29e07307d0b878ed7d402b
  • SHA512 07acdfee5f8858ebf125c8c039a7826e868cbccec2595855e48a0350368cd7fa0ba1a0c698a526fbb445715b479ebdffc238e0bbb1e4f4ed58c3e974b52281e2
  • SSDEEP 196608:ZFFhju3jo2eGhs3TIcNtqxIe5uKZ3yPrjokDBMeYBc1lyd4PJTt:Zpju3joIhs8127PXok5G4lyuVt
  • TLSH
    T1777633978B66CF8DCDBBCAB791736885FC9410F4C274C50B88A4655BB8839E50D62B33
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionadwarepersistenceransomwarespyware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2
• • Target
    Natro Macro v1.0.0.2/nm_image_assets/gui/bitmaps.ahk
  • Size 23KB
  • SHA256 29d83d620c45cf9de89a699ed355d3c9d1fd2e31182e60f465a68217d3f9ddaa
  • MD5 a9d6e82665b29d6d95306dee363a7515
  • SHA1 efe8639726616f3b26d3f2050b27df78dc904526
  • SHA512 4824f7de198055498fffb03f04a097e97b9fe710205098471e336f7a41280d6dad97605dde8401eba9dfec60e5f01f422616f4a0b64ccf2e43092f7517fade09
  • SSDEEP 384:0DFlDYimsHLe1eQy5HDdyNu7glzTRMNDdqwZmL9TNDd/pRkcDdnZzVgJ7yiDdCPM:0J53vHKQ5ENu7gdTRMOwZmFbpeYZzykE
  • TLSH
    T122B28DBBBB3B3B0CC35A8B05BB2664372E1C19DB0E5116B8087E37415DAD714D5922EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  executionadwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4
• • Target
    Natro Macro v1.0.0.2/nm_image_assets/gui/blendershrine_bitmaps.ahk
  • Size 130KB
  • SHA256 e079d4cdadd317e88f61f106a4c131fe5dfdf0e93e851e8708c86cc0f004dec0
  • MD5 a97127d6145bacc2a17a3d6fac5fb614
  • SHA1 b44cff8d9aecdcc1ad1455cc91983599837c533c
  • SHA512 99e4bcc96ab1b6055fa9a220107c0cc3bf4908c8cd3c7d4c446d60b4c4b5a64ab4e4a5684832ff45bca4a2b4adf2b624be93a383b140ee38adb7377ec99571ad
  • SSDEEP 3072:0hBdTXTFbcVtONV9IuB0HT8/MCfbS4szucDFC9x05pk6JvD+rax4C5g7pNHGKFZv:8FYq9IU0H4/r6VDFb5P1g73Prp4Q
  • TLSH
    T175D3027B1F2E6F3283849AF672751C085CB71C1952A0D019BDF8EB5E85D9350BDC27A8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  executionadwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral5behavioral6
• • Target
    Natro Macro v1.0.0.2/nm_image_assets/inventory/bitmaps.ahk
  • Size 9KB
  • SHA256 b5c4e732f8baaf36dd772cf18b57e4f0c4f122e53cf6f3c28b211006fa1e93c5
  • MD5 a47ef1731b212720c3171aac6ffb9eae
  • SHA1 c835cb6d5f237e47cc06219be0ad5f869975832a
  • SHA512 cbd1052c34ddd12cab350cafc24d8296de646d957a2fb5de666bca2b38149bb9efa6332a4a2c386f2fff9b5f3cfc46657dfccbaac89796ae4bfc49ff2db126ea
  • SSDEEP 192:fYkIXcGCcnTFkrGp7xGBWy0rRDi56s8ncbdJvj4Or83CGY/2W4uPJ:fF4cZgpkrM7xGBWy0rRDiEFnCdJv983G
  • TLSH
    T1492222320467BDDB27730EC524993A928C371CABA3BC5165BE89D8E251C7210EF5AB74
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral7behavioral8
• • Target
    Natro Macro v1.0.0.2/nm_image_assets/offset/bitmaps.ahk
  • Size 1KB
  • SHA256 4cff3fdbe88cba8fc14e3f37980b07b760a958184e520fb7afc4be6cdaadad05
  • MD5 93c5dbb5cfb8578fac2726d0ed31fbe6
  • SHA1 9988d96916939454ef73f81847fe200a58331661
  • SHA512 6fd2d0070819847326ff2f191edcf9a74057a773f9490bbe141a9c4b7e7db47ba337e4f8a91193509e8fa97ef6494b895eab198a649f301eaf36f2e600f3b329
  • TLSH
    T172317231ABE8210B855B8F0426AA56316D149CEF86EB026C321362184F95F18C4B6B9D
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  adwareexecutionpersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral10behavioral9
• • Target
    Natro Macro v1.0.0.2/nm_image_assets/perfstats/bitmaps.ahk
  • Size 4KB
  • SHA256 5aa43b1d214da01aac229f9c6e16825bb3a697da71d20bf94ee209d93556a52b
  • MD5 ed39d44fc384aba82799d903e8fb7f3c
  • SHA1 62e0bdd417ebcc58405895fc3ce850943e2c490e
  • SHA512 e73264671cea13863c2ff00d181ad31ef76da3d3c58d7667213e743746c908e66be36c7b8b778884cfe4626aad4dacc252741db2500005300090554258d6af8e
  • SSDEEP 96:Dk2MSBCiHzsWNFx1MSBCiHzHINPt1MSBCiHzHINdlSi:A2E21EB1Ed
  • TLSH
    T11781A434ABE9150EDE934A08397F2A220D3C596F05BB07ADB39F72455BC8B18C644DAC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral11behavioral12