743ed5f99e28a1ea6533b09e0ffa8769dd506bbeb6ef0f89be79bd0371dd0769

Sharing

Copy URL Twitter E-mail

General

Target
NotebookLM.zip
Size 4.1MB
Sample260908-chsgyace88
SHA256 743ed5f99e28a1ea6533b09e0ffa8769dd506bbeb6ef0f89be79bd0371dd0769
MD5 6ab28297130a4f72a87942c5dc90ba91
SHA1 ae9fc1afc44ed4667a8698eba9289d58d1e46ee8
SHA512 39418feff6d5e5b33a3540ac0c6ce48ce0782e4c596f9d11d510cc299f7c08de245436715539300e22b9f0c52a5619d743e5db59bfe8b714e9b3ad5470c9093a
SSDEEP 98304:89x5saWf18P27vVGm1LtoWOJILS7MYFACHhIVtR7uC:wgf1XDXuzILSmgSVXyC
TLSH
T12E16237FE94FAB1BD60E8178C11BC60DB23EC54E69030F599E5E936039074C29BB6B85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  NotebookLM.zip
- Size 4.1MB
- SHA256 743ed5f99e28a1ea6533b09e0ffa8769dd506bbeb6ef0f89be79bd0371dd0769
- MD5 6ab28297130a4f72a87942c5dc90ba91
- SHA1 ae9fc1afc44ed4667a8698eba9289d58d1e46ee8
- SHA512 39418feff6d5e5b33a3540ac0c6ce48ce0782e4c596f9d11d510cc299f7c08de245436715539300e22b9f0c52a5619d743e5db59bfe8b714e9b3ad5470c9093a
- SSDEEP 98304:89x5saWf18P27vVGm1LtoWOJILS7MYFACHhIVtR7uC:wgf1XDXuzILSmgSVXyC
- TLSH
  T12E16237FE94FAB1BD60E8178C11BC60DB23EC54E69030F599E5E936039074C29BB6B85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  NotebookLM/Contested Will and Estate Vandalism/Sources/Contested Will and Estate Vandalism metadata.json
- Size 270B
- SHA256 d7a88e1393b33f76afddc373720075aa3b796e006946d614ad1894dab0eb29ce
- MD5 0c091507b0834a6855463ae9e049be27
- SHA1 5d1089542a93401814ff5c3dd7e642f2f1052055
- SHA512 ed3d8ca76ce69478d84eceb28f06e8b15c6727638e980bd8555a0879e0372ceb20b45477e1ac57bfc45296c7c71bf19d6b62acd5fab71f13424e2a71ff64d05a
- TLSH
  T162D02B24DF1F19979DDC0261006941B1DD41860325942C94F2820B4C4FD4C2815ED9A9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  NotebookLM/Contested Will and Estate Vandalism/Sources/Contested Will and Estate Vandalism.html
- Size 1KB
- SHA256 f79d6b0e84f223c67481dbd6ef5ab45a2508f2fe03dea967585debe57ef86f16
- MD5 95ef5ea278c5d577f540b7b74377138c
- SHA1 ecdf8f94a5fa2ca27c96045b442820562e4a0044
- SHA512 2ae491075e3541716bc560e75edd60b8a3e1d7c5256c7f4739f7f1d2ff23877f85ed1bc520055d2a65ea6606e94f094c1ea8d21be98515d8eb7dfabacf8f86a2
- TLSH
  T1FA41656FAB4B033A0E76A3A4F50F12C7DB1AC02D62726760888E018C5327D56D6FE2D4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  NotebookLM/Disciplinary Hearing for Serious Misconduct at Golden Contracting/Chat History/Chat Session - a442b6b9-edff-44d1-a5b8-c9f629c03dae.html
- Size 72KB
- SHA256 380b38cf47ab97a36ec1bd690294aa6e44f1c48cda07375550410583832c7371
- MD5 a8f0bfb3885db441150395d294c64a4f
- SHA1 075b1e8091ee60fbcbf2fc2a8d40805e512186ef
- SHA512 3a5840b26c9b4c1736edc74430915af8b873dd2988574514f51a08a5cd6a0b1b47d47e46d0eb2ca1307640be7d54bbcf38a4b8658d81c452cadcd83cb0b2540e
- SSDEEP 1536:kdMozIViKXWZdH47v2oZFWNQmU9WuTUrSybh:k2ozGiKXWLH47p4q97yN
- TLSH
  T1D173A6479329033D0E720A82691D17EF775CE0ECF35612E278DAE278211995247B7EEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  NotebookLM/Disputes Tribunal Notice of Hearing and Header Metadata/Sources/Original Email Header Data.pdf.html
- Size 28KB
- SHA256 30242d8fb3905f439efc884371e504d58ffb0b0dc9afdb9ccf559fda082b7694
- MD5 d00e797d15bd98b8dc9cdb12afc5f71c
- SHA1 ba1a77301a7c804440fca73ce7215a7e077b6f4a
- SHA512 e6f9845bc2ea92cf99eebd32ee1123ec52c347da41f9dd393abe700025930d9495bf9521e33b5f8766ad44a8a04a796b6e65a833937662032e626a5a9c855ce1
- SSDEEP 384:zoVfYQdb+OYoCk1o8sN06oe222ZGBT1Iz9dWXUH04QtkG6JrZJC/nP:0VQQdb+O+k1o8sKn2JIz2jkGOXC/P
- TLSH
  T15FD2944FF12207D5248D29A571323BD89087F38AC4295BD9096BE7F17DCE2C9BD1329A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  NotebookLM/Disputes Tribunal Notice of Hearing and Header Metadata/Sources/hxxp___www,whiteheadgroup[.]co[.]nz _ Triage™.pdf metadata.json
- Size 285B
- SHA256 da44d90608cf98380527192588caa47b78b12f39314577f5f59d68432adfcb7b
- MD5 9d6d42a1ae2c68670d433dc606c765de
- SHA1 1b17ca56ddbfb48db18e83d4e0a5347f57956ed7
- SHA512 b580b95c2dc697e7da5949ad49b6ac2f223ff2a93dbdc338193e8fe5c9898c02103affebc4ca3c93864d777748f9985c100afc893998bfbfc9aa21eeb15d0278
- TLSH
  T14FD02B20EE232923954E15B2D4964151F2C8A51774E82C9DF2460B4C8F59827B0AF9D8
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  NotebookLM/Investigation and Disciplinary Proceedings_ Jason Peter Clayton/Sources/0b5782286efc983e3a7e4d7a12f2ea7cf-e7bf3bb834ab7817 (1) (1).pdf.html
- Size 190KB
- SHA256 7edf923cf0f9903721f909cd8e882b92092649025d9fe8254f4122ddb19297b4
- MD5 1d90cbdb2c0be781bc59ee9cc50abae2
- SHA1 83f464cb58f08954070738fe5c35c632d35aa855
- SHA512 4612a20e8a49c5a1100d188383bfc4cc9da883cfdb51409f8ad1556a874baff2ae94ef799f5088cc38551d853a9f320965bec9aad6ae25bac09e27b1d9e6ad85
- SSDEEP 1536:OvQvYvvRSYLOyTE1Fsz6fYq3dmLHZBFozlgXu+yJJ2qtcuW:OvJnRSHj4bZBFIa
- TLSH
  T1D5142FD5D2C2C2D3AA90FAF2AA507C4CD2E16176D7F13A5A440F8ECBD4855FA920F097
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  NotebookLM/Investigation and Disciplinary Proceedings_ Jason Peter Clayton/Sources/78B-form Completed-6bbc4a0a09a55b75 (2).pdf metadata.json
- Size 279B
- SHA256 896aa0257a7add349ccbd8e9dca4fb16026ed1e273dfdd4edd119eba1d434476
- MD5 f847caf30affc140091f5d04ed3b0047
- SHA1 b31dc02c4294f3a3213dfdcd206f860fb71fe25b
- SHA512 3b2b09f771f33ae6b02ea782838c000dd4fd3c5929cc7ea19445d0d79d5871b4a1fa6552b4ff5e12c92af17caa624563d7588e0fcaf3cbf32fa7b401ff6b567c
- TLSH
  T1CED02B15E2A65A57914E417881A91D9AF381AA0310402C6AB25217CC4B94833A55DCE5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  NotebookLM/Investigation and Disciplinary Proceedings_ Jason Peter Clayton/Sources/Attachment 1- Employment Contract-8b54d00c5b40de1d (1) (1).pdf.html
- Size 39KB
- SHA256 f4e35e427c23def2e25c78d869554ab23970b9d07a68abeb081fa55d891df6f8
- MD5 e3ca566029e4a689d7ad3aebe371a43e
- SHA1 a9a0f7c40ffa784762aee59e539b2ec6867b404e
- SHA512 09e66a5414107038e94fc2cb1ee4c8016c38a6bec2541c24cc9e397f7c9db0a9f8ab95b871c50a0281410612a4cdb4aff438a8fe02bd9f1797c6c5751b475025
- SSDEEP 768:ZMnX9RCuEVz/XLGQDyK37yIiczq28sxmTImphlrZJ8s7O94Q31k7P0s7O94RFsZn:NziQ85zJclg1FgWxYPf
- TLSH
  T10503750FE30E233B0542E3D0DA0E55D7F768792863667858A4D9712CA34A8E7637F9E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  NotebookLM/Investigation and Disciplinary Proceedings_ Jason Peter Clayton/Sources/Clayton, J 21044133486 (7xCRNs To-1ad3df22fbe86542 (2).pdf metadata.json
- Size 294B
- SHA256 edec507d256ccd669b456f2d1b8b4c914a8cf65dd2615bfb8db835b47364b715
- MD5 f96fe4d943c5d68d2e2d24535b4d3be4
- SHA1 2555ab61a4d884714fe5e54f7c818bfe46c7fd2a
- SHA512 08cfe65121418d78e1f0359a9e4559430d75077faeb85e3ad0da0d0362f13d91123091bbebf6ec7035b9f28ef9a9b5f1aeaa27273bf9af165f144d5997027f8d
- TLSH
  T167E07D11E4721D1BA04E427082DD0C65FB80594310D11C5EB25303DC0B94831B0898D4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  NotebookLM/Investigation and Disciplinary Proceedings_ Jason Peter Clayton/Sources/Completely silent.html
- Size 3KB
- SHA256 684b452b04a5c599a39fd9dc960c03b3dbb4867405fb38c08051a6250804fdb0
- MD5 0242b6d547c3fcf61d056fcf454031ca
- SHA1 3fe6db663cbe1e7dad12439b73c8ff5fc888ec86
- SHA512 c27ce3148c9a75aa9cd9e12f572c57d5be6436298b04b765b0921e6f0e1eb06367f683cedc7da9e2ae3914ac82dd5208370543d1d5b6e38d5ef5f9eb7709aca9
- TLSH
  T14961661DF61923BB2E429296BD4F33DFF715D0BC321726E32986D03C628495591FA2C0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  NotebookLM/Investigation and Disciplinary Proceedings_ Jason Peter Clayton/Sources/I_ve ordered a new one but I have another to chec... - I_ve ordered a new one but I have another to chec....html
- Size 612B
- SHA256 d02042378432734785abe97a09782e95e6b60530b290c8a92671e8f4d507a567
- MD5 2c89b99c0f7ca6ea446226cc1239886c
- SHA1 52a5307e1ae8a9ad3a877d71bae1f72f51d51051
- SHA512 715252c3ff1a2cf5560adf0e2805383b1b548e1f07e9be75cda86f84ac1e38ec52cf45e890b3f39e801a7bde8d9679393c713d35c358f70d906553335e1eaaae
- TLSH
  T11DF04C86D2EE54570A96A13E90013CCEE0C981A1D3F13AB14C6F4C8BDE655B0D263953
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  NotebookLM/Investigation and Disciplinary Proceedings_ Jason Peter Clayton/Sources/Letter of Dismissal without Not-859b3fd7b6593fdd (1) (1).pdf.html
- Size 5KB
- SHA256 09e25629a220cda38f2f3c0fb0ab7f9c01338a1ca3e8ca4be472d428d4daa203
- MD5 431912a2489b6723dfcbb109752109c7
- SHA1 fb63e2b08bcc7642ed1e953d35ff0d28f05fe481
- SHA512 c5602132f863acb61163a2f2181a1832b7e444d2fe882dc55aaa1281ec60a08922fce9ae943cd2ef6f2c07d3368cf20df606917de0f7087244c6c5b4f19ce681
- SSDEEP 96:89abo0tJSnHOAHPOEIEGezIv9GY6tFBCY3LZJdFLdZhfVm7no9FSnLnI9doiR6gb:89abrtJAOCPOEelGY6txlLzVYv7LiR6G
- TLSH
  T144C1970FF78B23530356D290AF4A2EAEFB09903C536A74F61C595119237AB6B023F9D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  NotebookLM/Investigation and Disciplinary Proceedings_ Jason Peter Clayton/Sources/Meeting Voice Recording Transript-db1651edd4d094dd (1) (1).pdf.html
- Size 19KB
- SHA256 2d0656c0c0281352eead0b8484d05a7dec55be1a83aae0a81a93237e8725b334
- MD5 506f126569a2bd2a98dd905b07a5b521
- SHA1 10c2c2a88bb0a01b71bbb9f46106a8e1888b6863
- SHA512 b31f839fdaa0fef307d15b7c3eb10fbb6b5093908b7cf23fbef06d6fd73432a28d61d61a798ea26774dbf7b46255333cddf934a79e90fcf10b1bbc495a6b4e38
- SSDEEP 384:ij57alDNHmKbNWXRoXmQNvNzjI8fIfHdHsho6huPkF0GJ3:iUDNGVmXmWvNzjH5o6akyGJ3
- TLSH
  T1AE92942FD66343130681B760AE5D2D6DEF11943C63A6BA7A5C1ED20D732A23B423F4E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  NotebookLM/Investigation and Disciplinary Proceedings_ Jason Peter Clayton/Sources/Untitled metadata.json
- Size 481B
- SHA256 46f791f627b58a5049cd1362a37de9e92acb830e279d114d74be1a9589cf6dfe
- MD5 c703b551b243b18946e3b0760e5c9542
- SHA1 6ceb5e070270e0a73bd29b1ecb04b93ffcc1e309
- SHA512 d1ad0946252debbaaaf236dfd3c94c4bc23d9d453c5ba95e0f6b22c3f2490937a92ee61fbcc34a9813ca5ef6e47c2f605ef2d0215090214f36c4b156ab14810f
- TLSH
  T1A3F05401D2A22E47404D417800A4C41CF680341F25D83C55F3EB2BCE4F48C61A4878CB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  NotebookLM/Investigation and Disciplinary Proceedings_ Jason Peter Clayton/Sources/_What else would you like to know about the logs_.html
- Size 1KB
- SHA256 4a6d125d7007914e006c737a9cb88a212c7d9db7b63bcff5bcf8149292065afd
- MD5 ce13411c022c9713e70cd24d1c0afcd8
- SHA1 0f55a6639f47e34c6f698a3a534a153bbfbbba6f
- SHA512 9ffd72356c8746d95898b807f83f7722dd3b5f16b660dbd280abfaa3453f442f7ac35ef9ac8b362adc5e8a3f69cf154f7e97ec3e40538766f50f831994465299
- TLSH
  T12F21EE6F698E17650F821261BE4943AF218D90FCB38266F23C86C03C530339646BBEC2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32