5fd10e707d02d018d837d0ce682b0050f104c42b29a2b537c0f5ae20750c9b7e

Sharing

Copy URL Twitter E-mail

General

Target
PolyMC-Windows-Setup-amd64-7.1.exe
Size 40.1MB
Sample260913-l9ff5aab37
SHA256 5fd10e707d02d018d837d0ce682b0050f104c42b29a2b537c0f5ae20750c9b7e
MD5 adb418fdb36a9699e5d262bfd1b3d787
SHA1 0a6b0bf05dc9db40d4825adb54174c8f1190a3d8
SHA512 9652108956d3f28c68cd57594df490c33ef801efdd75e0dba3a14b5f82dd0ae9fd02a77a0e7c73dbccc0be653c19a0c77758767d5fb7b2dd20e41a6983c3a89b
SSDEEP 786432:jKBDIZMYdLGxWWTMQh+exfwogToLkTKO+ssIHioIFLU3Xgq9Z5Y:ji8VdLKWWTMQhxBnPOxsIHiXugQZ5Y
TLSH
T183973369C075448BDDBFB4B54A36F65141B86835500291B3B5C36B7BCD8FBA8A33223E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  PolyMC-Windows-Setup-amd64-7.1.exe
- Size 40.1MB
- SHA256 5fd10e707d02d018d837d0ce682b0050f104c42b29a2b537c0f5ae20750c9b7e
- MD5 adb418fdb36a9699e5d262bfd1b3d787
- SHA1 0a6b0bf05dc9db40d4825adb54174c8f1190a3d8
- SHA512 9652108956d3f28c68cd57594df490c33ef801efdd75e0dba3a14b5f82dd0ae9fd02a77a0e7c73dbccc0be653c19a0c77758767d5fb7b2dd20e41a6983c3a89b
- SSDEEP 786432:jKBDIZMYdLGxWWTMQh+exfwogToLkTKO+ssIHioIFLU3Xgq9Z5Y:ji8VdLKWWTMQhxBnPOxsIHiXugQZ5Y
- TLSH
  T183973369C075448BDDBFB4B54A36F65141B86835500291B3B5C36B7BCD8FBA8A33223E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 25KB
- SHA256 3d24b3050546f53b9703079cb1645ba31edcb4ff5c4599223f9621ac4889269b
- MD5 c5183af5481975b70110074a7f1a0001
- SHA1 c2539b313dcebba9c612dd41611277532a55cb21
- SHA512 cbd9f8f264b748921b9f6f310708047df45aae61815e9f27d3c014f1d96129c7aafa950db0eaf50226cb71a51e5a39d52f9fe8d46988c52acd6aff810e0fec8d
- SSDEEP 384:aP6bw0YTnWLboowbqPH3avHK5vO44OIxZ3cxxxxmx6L1llllEkMZI+ma:W6bnYzOPH3ag4OITQ1llllEk7
- TLSH
  T112B22A0BB3D294BAC567C034D5EB8BF2F672BD1225347A2E2621F1756D71E90CB2D40A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH
  T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 14KB
- SHA256 6af12deb32fd7c09b9b31c8a5f58f0751ed52c950b1d3c4cce2b76180a1f28dc
- MD5 bdf888b1ea7cb2e79b8be95076595d55
- SHA1 7ca378273b7f404ad61ea1b50650fc9770affc42
- SHA512 4b644acb70365171fbce36c272f11eca93ea3da400edc47689438380cbed8e196a8dc0aa2aa9ff5eaa6cc49ff762f5606fa9357a4ae710e9c1a0c0a95722cdb5
- SSDEEP 384:rTpfsAuS7nTRRK5v/VlilllllletY/HpYpxl:rVsRqllllll9vi
- TLSH
  T1DE52192F3B869299C85EE338E5EF5B31A6F3B4551135770E0725D605BDE0AB1CA3C088
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsExec.dll
- Size 9KB
- SHA256 b6b48d58046dff234a03919827ff08c07c516c4b34b2a8522fea3f3bdb88df5a
- MD5 e8b7d26a6fc964e4ca8dfb6dc07847ac
- SHA1 d71e3b21cffa0cff9acbb7dd75c7c0bd579b0a47
- SHA512 cbf552b312a33f3158b80d42c62e7f11c301df7cc2fa306ec6d2688788f5200c955e7f78839d3bb49efe277cfe49a5b6d9a64ac5831cc41a26515387212ebb89
- SSDEEP 192:MKvO9of7S3hHV6/laQi/KNzvB12HlkvmuSSu:MKkIS13v/K5vmlkXu
- TLSH
  T16012F70AFF5295FDC4EDE038C1FF4F2AB9B37848A176671E5A9219062D32F909078359
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Qt6Charts.dll
- Size 2.0MB
- SHA256 dfe3af18a2c87bfa62bb479320dcadfa871a53c70ec62fd77d223cadeb444ebc
- MD5 e055c3be6d00582e12a8ba4250d6e1c7
- SHA1 13e9b0118a054103c601fe9dda640442fd93d5e4
- SHA512 ba6d1964065f0345d42f7d4062fd0864c0355ed97a16e0155c7a190cd66a1a3d1404b3ad67ce5d1d859a9a38729414cb0f9288ccc4860c931d8e560327fe473a
- SSDEEP 24576:GIUztAas2RB5W+AYG6DVWEItGFzqMt8wfgED02+z:GIUGSRBg+AYDVWEItGFzqMJ02+z
- TLSH
  T17F954C67E1A358ACC4ABD53885576632F930785432386F2F0294CB361EA2E5C237FB57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Qt6Core.dll
- Size 6.9MB
- SHA256 9cf7924077f1ac8758a456e780d9f408c779e76e58680a77ef30ef9807295c43
- MD5 5220913e07675ad1ec73223a3e32a505
- SHA1 1237cd51cddec0368deb43087b27236325a2ecf7
- SHA512 2f9f0989c8ca8e2cd59b4ebc80401ef5cde6d01279e16786014d0018a614f15c3395dd43baa58baa293e924f3cfb8447e8ee258b706ba2323315fe195700ef66
- SSDEEP 98304:a6KfoIWw+xO/rjuIk+IpKFdu9CwJsv6teU3WzMJeEKa8:0oFw/uLKFdu9CwJsv6teik
- TLSH
  T180762913E5A360ACC1BFD134465BA772FA317C4942342A6F1698EB352F72E60673E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Qt6Core5Compat.dll
- Size 399KB
- SHA256 b26af9ed96292fb1aa20858f0cacb6873f7e9921ec2bb55b781be15a77918626
- MD5 9dc8669af639bac2b967ca4d348b9cfc
- SHA1 a098b8904c42ccd936c1f25e823555aa30ab1284
- SHA512 6cdd9b8355449bff313918101aee3173dd4c125a81c1ada2fd60dd80fe13483341ea8e0c5a23b2c0267e660692ba2cc8992ca7c1c262271947908d453ce65294
- SSDEEP 12288:XzN7hWJurOq9DdYyOqOl/cEmdsx2hdZEXSKhV:LOl/cUx2FgSKhV
- TLSH
  T1D7942A33F19224FCC06FD2388A979632F931789903392D7F5694DA352FA1E60667DB18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  Qt6Gui.dll
- Size 10.2MB
- SHA256 15c621c4e6d7ffb9adf2697754fa6c148070d88cb25988a152dd51119e191f6c
- MD5 2e7acf0c0243c918e1aa6e0913d9ad92
- SHA1 feb44a97bd66f0f7177926be2779160884c75415
- SHA512 44971bb079bba22159c486c641ad2a53de6132eea543fa13190713dd00e984dc92b7da468b0961d2854e2cc8f2cf6194d5fe6ae369c5cbed7d7052611ac274c6
- SSDEEP 98304:9Nw8mM3iFxFCIrDw3prRMzkvRgF5yVCcRikbjdYj1Ne2O+Ri7:9gM3gaIrMZUEOq
- TLSH
  T1C7B62A57E193A0ECC16BE1354657AA33FE31784801386D6F57D0CF392EA2F50666EB28
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  Qt6Network.dll
- Size 2.1MB
- SHA256 e6844b162d918c820ede96fec17c692fb3112143ae6ef486b2b11e87f5a17b96
- MD5 fcf739685ef8d0343344e8b1eabb6c79
- SHA1 4d17a9531aa03ae4df963b2c4cd3aab2b2db892a
- SHA512 8953dc5fb6f4cfb45599cc5029eb951c3a7bd06abd6e049c9ec16e2a362d54d5875e801c3559f2ef76aa97a76039deacd3b4ac5332879a7c97667053da18d10d
- SSDEEP 49152:4QFftcqBnqyLqexRNXaFm0v9QSr1UHlLV2n8D1eHd3dEdqdkdvdddzQ616PYQV4t:VPLq8hcQesfuUqm
- TLSH
  T1C1A52963E26260ACC4AFD1398647A632F9317C4942382E6F5794CB362F92F60637D75C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Qt6OpenGL.dll
- Size 619KB
- SHA256 24eead7fa9ab6a9690cc80404e4265782bef63471d2ede4d79076da421677dd9
- MD5 776ae562dbe733143cd52d752b028903
- SHA1 d0269639fb18fe3725492a5f125ee414230515f9
- SHA512 915264b3fe56b152c4f5961c3cb668c6d3385010d663c7b8c85612a473902af30aa207708e734b7bea3e9b1aa8826b5acab17546610d77c8bd985abf30e2bfd1
- SSDEEP 6144:DqQ4CfAhToqPZW81Pa+MtdET5qTsAxoul/8ETGuni4nRI0y5VGSjsJPhUGYt/ovi:uQFdqPZWqPa+es8N7Bi4R4siQH8HmGx
- TLSH
  T115D42BA2E192786CC85BE27E838B6A35B671BC400174AB6FB14CD7362FE1E20137D715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Qt6OpenGLWidgets.dll
- Size 64KB
- SHA256 b324da1fe4874196875c53b26feb45a946e5df5b22eb1ab0cb341f63f27fc94a
- MD5 085802e03f8bc7ddce6936f4dcb9cb8f
- SHA1 6e7bab1b9e42ecd87963685dc35a280558961934
- SHA512 20ca8909c26c188f26213aa48875e0f86bc5eb9d92535e085a402facf93a8170e8292e245649ed624c5ea3450917cdf0b5f8b162d9b79201c5e65c1eb7d76082
- SSDEEP 1536:RJYItsg/IHJsRLG07BQfTv5Ik27LJdwE0ZEANYVcIc:77+CIpsRLG09QfTChbw9ZnYWIc
- TLSH
  T16053E6B9264498EEC9FAC27CC6CA473077B03C648A661F1F019CD53A5EF4AF45E29B05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Qt6Svg.dll
- Size 694KB
- SHA256 ca6c5646119437e9f845a55d4af4ee0d4f062a48d188ea7ad2717c2401796005
- MD5 aff028124546cc2bbb700985829803ea
- SHA1 ba69bdf895c511970e10b38ada1acb525e2a4536
- SHA512 073cd49da4ecd81bced8dc1a91003be9641bad3abed4ab65d8f813584bcb33ffaa0ad8b59febc98583558cc41ee4536155daebe41494cfe7f73bd2e0bbb100d4
- SSDEEP 12288:h3zts5Ltwhx4Rys00F9MOAjaBD3d8jyydx62r45ht:h3zt46GTfMOA+LCjyydxNr45ht
- TLSH
  T1CAE41863F65264ADC0AAE53D9247A672FE327C4812382D3F57A0CF356A91F60623DB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Qt6Widgets.dll
- Size 7.5MB
- SHA256 7ec718d152ce151939f394905acccbf62480eb837aeff9ee97cbcc586f221ad7
- MD5 1af4f567a6a5561da8014c984a253227
- SHA1 384cd586bd3f207ef3a75654246633bd21e7aeae
- SHA512 b0ad24377e766bf2394f7bbd7629dc3f095420bc49e2af8c0c2ed7aa5a25fb6b2984afc8f91254b6400773d6244eeb81e847b05b01388dfa20d80354761b20d3
- SSDEEP 98304:Bx8jHb90rHqknstP7Gp2uXlSaw3hiHT6NJ2z++/X4:qvYDwwzRM
- TLSH
  T181862B53E1E364ACC46FE5388657A632FA317C9842346E2F5690CF352FA2F60623E754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Qt6Xml.dll
- Size 161KB
- SHA256 e838e20e9d7bd6b8914f62eced107a8433cc996b44daab0633fb698acb0dc7a8
- MD5 772f4b7256e9b8fd65642a1e5804c651
- SHA1 aae3febe03bccdbbef8b469189242d2b128ee467
- SHA512 7035ab87b624153e48406ec2961392c31acc739db4bd98924d59b942f46f9f39a85e8b808dfeb531d9f5558ecc7900730d0fe8be020a35daedb3ba0be202d24f
- SSDEEP 3072:WSdG3QKBaq8o2wJFGHhQCG7FZM8mLsCIfKyJ93DyFFqE:TdeQKBaq3G+C4yvIfJ93DyFFqE
- TLSH
  T1A2F31973F69294BDC5AFD13880674736FA31788807356D3F9794CA361EA1F20A23E664
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  iconengines/qsvgicon.dll
- Size 71KB
- SHA256 38df55f8e45ec6e098bd704cb8a502cae8000af69a08d8b73aa6c762efb17f63
- MD5 2b8004420c227e1004e3854b176af713
- SHA1 0540afc50d4cbe83cc8ed2c9b0aa54994cbfb63c
- SHA512 7d7fc5f339a335c7696fecc3990568fb434107aa9ab75aed0de6548dffce27accd7a935685ca1ca79c14fd2863106b5be6f7053bfdc8ce2a96ff605c0c8ee90e
- SSDEEP 1536:L3o1CujZ3akBCTzEj24v+rZnMQtZxGj4zrf0hyC4Ty3ah:LCjZXM4v+rZMQtFf04C4TyKh
- TLSH
  T16F631B7AB29615ADC4DFC23886CB9531BB32BC5207346F6F56C0CB371EA2E605E58B14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32