ffc755f7de8bac9cb4f9e55382611a3efeb01882e8ef40107ed87c1413048d06

Sharing

Copy URL Twitter E-mail

General

Target
植物娘大战僵尸电脑版1.2.5.exe
Size 924.0MB
Sample260903-wd77daseng
SHA256 ffc755f7de8bac9cb4f9e55382611a3efeb01882e8ef40107ed87c1413048d06
MD5 fb046cd8c2a490d93ee660334001f1e5
SHA1 415ca4862d052cca0095262cbb4e4a60877c89d0
SHA512 296bb2033e5eb016fad702f4bd6a38dad6273e2533d712dc4d719274c255698f4f10677f71f2d1c6a5641e0b6a17efa34fe37707623b63e461ea29c00f73bfe8
SSDEEP 25165824:D7lsaeX6uxM3g71SteIoXkzwDIlrouzG6RsHg479BYlwIv/gm8B0ySt1Y:DxoKuxigoteI8kzNhoqGGsHylnvi0s
TLSH
T15AA933E1558BF7ABF63F7836C5244808665C53774A8379E030B473FD6267B6E82A0C26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  植物娘大战僵尸电脑版1.2.5.exe
- Size 924.0MB
- SHA256 ffc755f7de8bac9cb4f9e55382611a3efeb01882e8ef40107ed87c1413048d06
- MD5 fb046cd8c2a490d93ee660334001f1e5
- SHA1 415ca4862d052cca0095262cbb4e4a60877c89d0
- SHA512 296bb2033e5eb016fad702f4bd6a38dad6273e2533d712dc4d719274c255698f4f10677f71f2d1c6a5641e0b6a17efa34fe37707623b63e461ea29c00f73bfe8
- SSDEEP 25165824:D7lsaeX6uxM3g71SteIoXkzwDIlrouzG6RsHg479BYlwIv/gm8B0ySt1Y:DxoKuxigoteI8kzNhoqGGsHylnvi0s
- TLSH
  T15AA933E1558BF7ABF63F7836C5244808665C53774A8379E030B473FD6267B6E82A0C26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 245597797e73ddac0b2408a6736e883461c5030dfcaf2f2a6c08ba04b6989c34
- MD5 5e422c6ab294bb8cff15996622c8ccce
- SHA1 b63a4c61d8843f56058d9706167fa9b26e422f42
- SHA512 edae552c2af7a64fa7c1fe2b43c9f15585c0cffd4c652977333525a2dafaca70b9aaee589d69cb2efd358482e14f4ea95f444fd338b58c418d404b585168b1c5
- SSDEEP 192:f8TiS2p6uXjL1ZRcFsMaRqllbYIlcXvh0NqesZ6r6OMc5eWL:KiHXjpPcFsMvlls/SBZr6Ob5NL
- TLSH
  T154425C426BB25AF1FA25073625B67F170B3CAE5803D44A9B8FE79444E8B01E710367D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 9a4a803f39fcf90f71d0d52b04030914ba4e1689f3d8d5ba91209bba1bcc1148
- MD5 7c2a48cf2e50747ef5fc14bd5b7e216f
- SHA1 a05b28cf56f5529844e633138fa057b6b1fee422
- SHA512 b72ad8dc55743fea9b545b39b541c8b750403d537495fe96ea1988b9723c866323a8eb600025f4b7e20f1824dd75cdea52cedd77220dbb77a3754ce7549fabf4
- SSDEEP 192:AaBOXrK3v76wuechIJgQhWku8yeNGdvCyikhYK5:AaEG/7m8hoeNGdvCJK
- TLSH
  T1B812E69772A8C4F6CA9F51312A866B27C374D354B0E17C0BD7774A4E696B28A3D3D302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  Lawn.Console.bat
- Size 50B
- SHA256 69cd74bd1031ca816e3b85333b86d1fab9e830cdcad83db6b881ba500c1ebd39
- MD5 a3c49ca768cd53d519d574721b05d0f3
- SHA1 9cdaee3db06c729000014cf70d37deed390f0873
- SHA512 6a21611ec21e9012a5f432e87797b135c0de694225465fa0fd0449a4ae72874df2a818165fb6a73e8e7cea763466f0460c28d9c9c8e76d729286ff9795af3a38
- TLSH
  T1FB900207445022296145044259593796AD96949004645605285E057A2A45C6D1A43459
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  Lawn.Console.exe
- Size 237KB
- SHA256 fa848900c33c59691aa41da96f0b9968921110176dbcd459d45c58aae5af881d
- MD5 0ea9bea7d7ebad5c4ed4304eb687e418
- SHA1 6e7d2493ed7e1f776e0a1a92019033778c50c492
- SHA512 eb23b9675e745560a2f322e1970ce069b51727e3296fd41ba1d51cb5871a083fbb0d0c25ab8fbc853b903d8f17a17bd3fc754fa1a2f2b4ce699c31a30c9d9e05
- SSDEEP 3072:Wczkitvo4BpYN/6mBPry8TXROLdW5m4mURN9OOGU0kUq1zd6fn9x5iGXfNdaMEjp:WA4NCmBPry/N2dOO1R4zveN
- TLSH
  T1A0348C1672AD11ECD1BBE23889964A02F7777816473693CF0390867A0F77BD4AE7A311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Lawn.exe
- Size 73.5MB
- SHA256 ec019f3d8f09d16b2f259b15ad1a9585656b9570007f06f516b625f66cb8be9d
- MD5 430332d28e3d715f4471fde4952db4b1
- SHA1 a3663cfc2e194abb41fc104fcaa5bcc43dd31b72
- SHA512 4f694109de4f2a10139cb5a5a97c7ad8a26c8a8d288dad9927d640d29e09f78b4458f7bbe86b637d3c2d961fcbfbc342b095e5ecf19c17f987e9c74c02cbb1e2
- SSDEEP 786432:MMBTn13gZnOY+mmzLWN3KPqiVmSYb3zv3C:Mc13EOY+XLTVmSGa
- TLSH
  T16CF7BE15F7E84616E56FC3B9C5638012D6F5F4862322E7CF0414EA992F13BD2AB36263
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  SDL2.dll
- Size 1.2MB
- SHA256 d274d4975307039570c4e10f01e6d53e50e80bc5a2d46db8d7ef550ca623e5ed
- MD5 111847286086a816fedb344a333e410b
- SHA1 0247fc17827e60f56e8d9dad4fcb0c90250bd9a8
- SHA512 7e86b9d1c03ec7e114ce01c4a102160010c43858cd2d25e38c158cbb9ab90a945ce8872a12522d5ba720f6faba24261058e2e9b8a1fd10667e337097bce13881
- SSDEEP 12288:/YstE8vQXNJgjVMjFs9WW+Y5cEciDB3p3nERERRRRR+Z3fyFeGgb39n3xELWsJXR:/Ys6SgNJgjmjGWW+AcoaZ3K1g5ZqB
- TLSH
  T19F558D0EB3A705ADD92740BAC297721BD275744823C05BDB7B580BE92E23BE1163F725
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  soft_oal.dll
- Size 938KB
- SHA256 410904fc0a4fa88b8e3f01fc3e6f8ae44e3da48ef307d110ffe26dd8f50f9e90
- MD5 89287d57c2f7bcc1f38bf23905aa1e34
- SHA1 77b4ffcad5d175b89aacb363f8440c4ebbd5fc8b
- SHA512 11db7252927ffe1baf60d03d203a61571281cc0dc36879da2d67935fd7492d2235b096f3c77ba3bb68e3f78dac8b0d46970bda804a0510a0007340fb05534bae
- SSDEEP 12288:uuZjrGe+8qC8U2xBKkN9wpr+/kOwzU4vDI/XPlJtsSyc54YcmMronus2bC4Ey:u1hC8hQE/WbI/9JtsBYZv2bC4Ey
- TLSH
  T179156C95B1E28CEAD63B933441D3FB33B538B4440322DF5752A0A9355E67FC02E9AE51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Drops desktop.ini file(s)

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16