Overview

overview

7

Static

static

7

STEAMRIP ...es.url

windows11-21h2-x64

1

The Henry ...IR.dll

windows11-21h2-x64

3

The Henry ...15.dll

windows11-21h2-x64

3

The Henry ...ry.exe

windows11-21h2-x64

3

The Henry ...32.dll

windows11-21h2-x64

3

The Henry ...64.dll

windows11-21h2-x64

1

The Henry ...it.dll

windows11-21h2-x64

3

The Henry ...cp.dll

windows11-21h2-x64

3

The Henry ...in.exe

windows11-21h2-x64

3

The Henry ...Wo.dll

windows11-21h2-x64

3

The Henry ...pi.dll

windows11-21h2-x64

3

The Henry ...pi.dll

windows11-21h2-x64

3

The Henry ...00.exe

windows11-21h2-x64

7

_CommonRed...up.exe

windows11-21h2-x64

7

_CommonRed...up.exe

windows11-21h2-x64

7

_CommonRed...st.exe

windows11-21h2-x64

6

_CommonRed...64.exe

windows11-21h2-x64

4

_CommonRed...86.exe

windows11-21h2-x64

4

_CommonRed...64.exe

windows11-21h2-x64

7

_CommonRed...86.exe

windows11-21h2-x64

7

_CommonRed...st.msi

windows11-21h2-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    The-Henry-Stickmin-Collection-Steamrip.com.rar
  • Size 414.4MB
  • Sample260828-nnbl6axamb
  • SHA256 8af4fdfaa587d1072aa479ed4f3fa8d6431232da133b12eb081733b40d362d18
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistenceprivilege_escalationransomware

Malware Config

Targets

    • Target
      STEAMRIP ยป Free Pre-installed Steam Games.url
    • Size 121B
    • SHA256 83b3dea5feeb0e8b98b33b647634264abeb7a069801833bf3d80836405921786
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral1
    • Target
      The Henry Stickmin Collection v11.08.2020/Adobe AIR/Versions/1.0/Adobe AIR.dll
    • Size 19.7MB
    • SHA256 e5efca0b15127161f055826b89dbd115940f0748f025464cb94eaf0766b3a90e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral2
    • Target
      The Henry Stickmin Collection v11.08.2020/Adobe AIR/Versions/1.0/Resources/AdobeCP15.dll
    • Size 3.3MB
    • SHA256 6fcf417f525f29eb89243afdf82a97f9e85fb468e042b0f87cb6fc68d8933901
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3
    • Target
      The Henry Stickmin Collection v11.08.2020/Adobe AIR/Versions/1.0/Resources/CaptiveAppEntry.exe
    • Size 81KB
    • SHA256 03e67b6cd84650a56d6ed8f9a8c04de14c5660ecd715dc5cd4c7e8cf04acf886
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral4
    • Target
      The Henry Stickmin Collection v11.08.2020/Adobe AIR/Versions/1.0/Resources/NPSWF32.dll
    • Size 45KB
    • SHA256 b99a91d965af4e4941a26ae785713e12bb86f010d1adc6079bdd3ffdc896a69d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5
    • Target
      The Henry Stickmin Collection v11.08.2020/Adobe AIR/Versions/1.0/Resources/NPSWF64.dll
    • Size 46KB
    • SHA256 a6f05dc1f9e24e79dbdc87f35b57b9a49eab03b1ac057df0bae669a60fb24e60
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral6
    • Target
      The Henry Stickmin Collection v11.08.2020/Adobe AIR/Versions/1.0/Resources/WebKit.dll
    • Size 5.4MB
    • SHA256 df04691727871b9b099a374cac70dd7e0808d992b6373b6fe6228107a5e224fb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7
    • Target
      The Henry Stickmin Collection v11.08.2020/Adobe AIR/Versions/1.0/Resources/adobecp.dll
    • Size 5.2MB
    • SHA256 2aef462048b16547dec95b194dcec3b0793f53e6f345ef5abb997a97eefff29d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral8
    • Target
      The Henry Stickmin Collection v11.08.2020/HenryStickmin.exe
    • Size 96KB
    • SHA256 61e4cfd5dc011109dddc75391ad5ef5a97edaeba86d3f81b35df2ca6723a85c7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral9
    • Target
      The Henry Stickmin Collection v11.08.2020/META-INF/AIR/extensions/com.amanitadesign.steam.FRESteamWorks/META-INF/ANE/Windows-x86/FRESteamWorks.dll
    • Size 313KB
    • SHA256 ae6f3d2a05d11af1b084cf09b2bb82ca3c8d6c07191d30484e6c419680a744b7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral10
    • Target
      The Henry Stickmin Collection v11.08.2020/steam_api.cdx
    • Size 253KB
    • SHA256 14a33924adc495f3c27dde65ae4a8007c8acdc1454fcf87f02d12040cd751741
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral11
    • Target
      The Henry Stickmin Collection v11.08.2020/steam_api.dll
    • Size 315KB
    • SHA256 1e4ad44a77870ba09a67e5690557832182b69d2a0e1f25b71973ab65da245f9d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral12
    • Target
      The Henry Stickmin Collection v11.08.2020/unins000.exe
    • Size 2.5MB
    • SHA256 a3ff79e2a3903a3397dfecd46c94f1536b9705e00a69307a030e56e790fc3e3a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discovery

    • Deletes itself

    • Executes dropped EXE

    behavioral13
    • Target
      _CommonRedist/dotNetFx40_Full_setup.exe
    • Size 868KB
    • SHA256 fa1afff978325f8818ce3a559d67a58297d9154674de7fd8eb03656d93104425
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral14
    • Target
      _CommonRedist/dxwebsetup.exe
    • Size 281KB
    • SHA256 111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discoverypersistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral15
    • Target
      _CommonRedist/oalinst.exe
    • Size 790KB
    • SHA256 b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    discovery

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral16
    • Target
      _CommonRedist/vcredist_2015-2019_x64.exe
    • Size 14.3MB
    • SHA256 b6c82087a2c443db859fdbeaae7f46244d06c3f2a7f71c35e50358066253de52
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral17
    • Target
      _CommonRedist/vcredist_2015-2019_x86.exe
    • Size 13.7MB
    • SHA256 ac96016f1511ae3eb5ec9de04551146fe351b7f97858dcd67163912e2302f5d6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral18
    • Target
      _CommonRedist/vcredist_x64.exe
    • Size 5.5MB
    • SHA256 b06546ddc8ca1e3d532f3f2593e88a6f49e81b66a9c2051d58508cc97b6a2023
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral19
    • Target
      _CommonRedist/vcredist_x86.exe
    • Size 4.8MB
    • SHA256 8162b2d665ca52884507ede19549e99939ce4ea4a638c537fa653539819138c8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral20
    • Target
      _CommonRedist/xnafx40_redist.msi
    • Size 6.7MB
    • SHA256 e6c41d692ebcba854dad4b1c52bb7ddd05926bad3105595d6596b8bab01c25e7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discoverypersistenceprivilege_escalationransomware

    • Executes dropped EXE

    • Loads dropped DLL

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral21

MITRE ATT&CK Enterprise v16

Tasks