1ca4d6653cb45cd819c2979650ec1950b6e6ccfb62c65e0117a2fd11779de3bc

Sharing

Copy URL Twitter E-mail

General

Target
workingtimetableprinter-2.8.1.zip
Size 9.8MB
Sample260908-v6ak5sha38
SHA256 1ca4d6653cb45cd819c2979650ec1950b6e6ccfb62c65e0117a2fd11779de3bc
MD5 1e42bdde1005f4e70327e874874f4579
SHA1 98399270abdfe1680c3f88b108c42a76dde052ce
SHA512 1291950cab5da0ed87b64012eb0aecaa9508bb7b99317972664d31cd05fb2544c62d9256065df85498b9a55f09f5a9b1711ddab138b8713540f0090b67501daf
SSDEEP 196608:IyOS4KZoBDZzE8zY2iQdI0pIJxZCRVlAo0zL6kFWr/QR0dCaUev0e0aeOm:IAWDZzhzYTmI0mJTCRVl2zL6kMfoWvjK
TLSH
T1C5A6339741C3DC4835CD0FF2B7AEAF856BA5BDE5E1CC9A937890005AA6938C09C5B813
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  workingtimetableprinter-2.8.1/libcrypto-1_1.dll
- Size 2.0MB
- SHA256 79329a435a327563962a3d9d656125e9f8eb2204b05acbe327b56f3a8f382a47
- MD5 30d2c287e2006349b1deb06139431166
- SHA1 43d29bc27ab3992afc119a3b60cc86618aeeed42
- SHA512 3df097a2bd0b1e97b5e0570c4805379f397bfda3107ba58223e844cecd1acbdfef70f5cf993b8ee6eb5cf19b3f087da0f5e75c0ded5c77c3d4687808864cd562
- SSDEEP 49152:pkv4EyvQ/qpyr0kAYdQqqW6qvHewDe01CPwDv3uFR0b5Yrps:pkvXyvQ/qpyr0kAd66oewv1CPwDv3uFm
- TLSH
  T193A5BF02FF971652EADF463E12EA573F8E365614C338DAD38E6128A5CC265C1273E394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1
- Target
  workingtimetableprinter-2.8.1/libcrypto-3.dll
- Size 3.2MB
- SHA256 47eeab06c3f5f0d0ac54ea85dc2c9830153bc62de18e551ce4782c83199e8754
- MD5 4b09345918e13dd2b20fbf087306c101
- SHA1 8d9b0efa1d7c78b3fba0b271a2a348c8aaf27ae4
- SHA512 3c64bae1edae6433a176964455a504ab707d6e52e7ee28e1e659b0c1ee96cccd428c8884539c2d5d4b30c96d5b1a2194f480ec11f2445cdb414e194499f57cb6
- SSDEEP 98304:ezjTwBaUxT4d3dW1+x1CPwDvt3uFlDCF:faUxkd3dW1+1CPwDvt3uFlDCF
- TLSH
  T174F5AE02FF976681E8CF867E12EB537F4E391B14D724C9D38E62289ADC255C1623E391
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  workingtimetableprinter-2.8.1/libeay32.dll
- Size 1.5MB
- SHA256 b0932c8112bc6514c28295aac75e245c885308e232bbb67478a29545f55c5393
- MD5 40b851c34474e807102edfe738344c08
- SHA1 3f9a4ed34f8d12f5f1b6b7af3593e93c35339276
- SHA512 9263ff2e0b2dc0c2b3fec6fab1a2216fdf587c6a9a26c1b608381e94a7d5c2fb576a4397f54a64a72edbbdaf550ba89c89f1d262414f8b3a0a9ad01ca54f2dc6
- SSDEEP 24576:a2RMg+57PruwjK2AZB0glzHKY4KhNK9mp7Nk140qbj/qbVP7YEA:aNTucAZpzHKYrZN10qbj/GVzYEA
- TLSH
  T1A5754A44E98B08F5FE671E72845AFBBF0A205A01C830CEF1D568F55EFC33A9B111A659
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  workingtimetableprinter-2.8.1/libpq.dll
- Size 262KB
- SHA256 cff5388b56cc9afea1242d829ea223bba129a0f3e690892fd2a8155d463da684
- MD5 fa2525cccc3b661020850d5044bdc354
- SHA1 e458542a66041ffa6c8af5780b41613d3c625aab
- SHA512 b4def873ff41c80108ea9fbb6913aa43c5491b9a58d5c2a3cafd7f45f4d524e5931b1c6fd88ca10534dfcfdde3bfd5aa6af4d78cbfe76854a6753f4a42b3aec1
- SSDEEP 6144:X148/QUoVMUO6TDOCwYRf4Pc4iTKLSwJKoQiHzI4l/47sx7apSPlLq03:C8/svgYN4Pc4fLSwJKod2u5q03
- TLSH
  T107444901B8814E2ADD9E037A8EBFCBB7DD2C50211321D9D3A3916CBC75564FA627871E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  workingtimetableprinter-2.8.1/libssl-1_1.dll
- Size 366KB
- SHA256 aee004384a528905e5caff289ebf4bb3fdc48cabbeb97c966ab786d3d3fa2910
- MD5 38e48077363026e701a0ab3f254a09d4
- SHA1 6d1726ddd0b822366ea17bec0ef927ebb0942575
- SHA512 e58a423713580d634b72258698355afdc5d2c9c2a2378e4dfc5cae794dfdd8385a212ff6e16d2c1599ba0c883673eadd767a69a4f80eac96af325ac98a937456
- SSDEEP 6144:ZNOOCv6hBS+/WkxdL2yhRX+lrQTr6mNMPQoVIWeCiOfBQJlyCR+3S8SR8hiKcTKi:POT0BS+ukxdqyhRX+lrQTr6mNMPQoVIR
- TLSH
  T12E846C01F78399F6D886867D72AF27BA2A3DA700132CEDD39F611D648C362D1563939C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  workingtimetableprinter-2.8.1/libssl-3.dll
- Size 607KB
- SHA256 8572a455af22cc32260cf1997e6a6c6edc53faf924d00ffafb637758f07e2c34
- MD5 4b3e67b8cd5ac309d32f567be331ac84
- SHA1 877439506bff1265eeefab273e4995166d21d45d
- SHA512 a588097a859e38a5331cb9daa89d41d8649219658ac7f2eef86c85226b71e20ace0da3420c438cdd7d1927eee2381be9f30054bacd5bb87207d897348ecdd8e4
- SSDEEP 12288:kQeqHbFUqX0lFsvWHOjI4/zsZZ1CLUZcAjIsRZGc3dnwFe9XbG1w:RxkleqtcAic3dwFe9XbG1w
- TLSH
  T12DD47C52A7C25C91E0C945BE19AB17BF5A3DA3046728C8D34F929DA5CC21AD2573F3CC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  workingtimetableprinter-2.8.1/metronom-workingtimetable.exe
- Size 13.5MB
- SHA256 b7ad08b918c1ce149b40abc162c9ebaf568a79283ca167c24ee4f23202343547
- MD5 c3ec2a081c0512a089a172dde1e667d6
- SHA1 c4f4b19c4797c2cf8dfb94c7f18db790eb6f803c
- SHA512 b612de79fb5a5fa2c4cd468a3d349b2c6b5e71182988a056ae4a20521943c3379c140d50db869e9bd40acc53d924483093c640bf3e6fc3b30ba1a9904b8fdbe1
- SSDEEP 196608:3N7VwXtZE+tBA9rZA0elJAKmhieLt4Ts34K96xx24QP53j6Q:3N7OXtZHkboJAKmhieh4d0Z
- TLSH
  T165E67B13B384953AD0771B36CC3BCA94693B7E302E26895B37E43D0C5F35681AA2A757
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  workingtimetableprinter-2.8.1/ssleay32.dll
- Size 361KB
- SHA256 8117a404f50cd2825d997c78577905aeda59e87f6cfa46fe9863280cfe525000
- MD5 7627e02bb3b1d4c541de04e6de19c11d
- SHA1 1de533f8c042baf91acc513f2941af9dcfc9a7cb
- SHA512 ffb97808ed1226769005efc7960b1a1d99876a5b286c7fb6e4a08bafc83d82148ce93bcff973b66f703abeffc578c518dc8389ec9f4f218044397d7607484698
- SSDEEP 6144:E1C4pcWY1GpT2WuPXfCTV7yYCOWasQ9C/G/XvOGpDu4ewjGZU0AjBOI5gL:ApTU9Bae/G/X+4v2U+L
- TLSH
  T1DA740814EA8749F1ED875E704587F7BF6A349A00D928CEF2EB54F54DEC33A1A5208638
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral8
- Target
  workingtimetableprinter-2.8.1/wPDF400W.dll
- Size 1.8MB
- SHA256 fd438a0a4a7d866ea4ffa4e21d7cde2e1e84b3b4bb5698490a69e3baf13d21a3
- MD5 573ab4e49dd425c711c1b3e49be497e2
- SHA1 1f42f40d1e4dc7dd9168d16eadd4d5d2b33ebe03
- SHA512 a1b517d79c74f6ecb91909d90d8ed719431046f8928db0f6630fd92a66f6d218f493e1fbbf8639aeb8c32d605cc2cb4208a7868ea3e356b44adb7779e811016d
- SSDEEP 24576:3dr3jTSiZhqTNDICZaWP2DbX8HtlLarE1FjHLlvBiTPdTRSO80uK:NrzrZhqNlJdH3arEnjHLuT1TgO80uK
- TLSH
  T1DE856C23B345683FD16B2A394877A390683FB72139569C4B7FE44C4C8F396806E3E656
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9